UniPass Wallet and Fireblocks address the Ethereum ERC-4337 account abstraction vulnerability

Fireblocks Collaborates with UniPass to Mitigate the ERC-4337 Account Abstraction Vulnerability

In a significant development, the cryptocurrency infrastructure company, Fireblocks, has successfully identified and resolved what is being heralded as the inaugural instance of an account abstraction vulnerability within the Ethereum ecosystem. This revelation was unveiled on October 26th, shedding light on the detection of an ERC-4337 account abstraction vulnerability within the UniPass smart contract wallet. Notably, this collaborative effort saw both entities working in tandem to address this vulnerability, which had reportedly permeated hundreds of mainnet wallets, exposed during a white hat hacking operation.

As per Fireblocks’ assessment, this vulnerability had the potential to enable malicious actors to perform a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. This manipulation is grounded in Ethereum’s developer documentation on ERC-4337, which introduces the concept of account abstraction. This paradigm shift redefines the processing of transactions and smart contracts within the blockchain, emphasizing flexibility and efficiency.

Conventional Ethereum transactions traditionally encompass two distinct account types: externally owned accounts (EOAs), governed by private keys and capable of initiating transactions, and contract accounts, overseen by smart contract code. When an EOA initiates a transaction towards a contract account, it triggers the execution of the contract’s underlying code.

Account abstraction, however, introduces a novel notion—meta-transactions or more broadly defined abstracted accounts. These abstracted accounts break free from specific private key ties and can initiate transactions and engage with smart contracts, mirroring the capabilities of EOAs.

In the context of ERC-4337-compliant accounts, their actions rely on the Entrypoint contract to ensure the execution of only duly authorized transactions. In essence, these accounts place their trust in a rigorously audited single EntryPoint contract, which serves as the gatekeeper, permitting execution solely upon receiving prior authorization:

“It’s essential to note that in theory, a malicious or buggy entrypoint could circumvent the ‘validateUserOp’ call and directly invoke the execution function, given that its sole restriction lies in being called from the trusted EntryPoint.”

Fireblocks’ scrutiny pinpointed a vulnerability that could empower attackers to wrest control of UniPass wallets by substituting the trusted EntryPoint. Once this audacious takeover was executed, the attacker could access the wallet and deplete its financial holdings.

A critical observation is that numerous users who had activated the ERC-4337 module in their wallets remained susceptible to this form of attack, which, notably, could be perpetrated by any participant in the blockchain ecosystem. Fortunately, the wallets in question held relatively small amounts of funds, and proactive measures were taken to mitigate the issue at an early stage.

Upon recognizing the potential for exploitation, Fireblocks’ research team took decisive action by initiating a white hat operation to rectify the existing vulnerabilities. Remarkably, this operation involved deliberately exploiting the vulnerability, underscoring the need for a collaborative approach:

“We shared this concept with the UniPass team, who took it upon themselves to implement and execute the white hat operation.”

It’s worth noting that Ethereum co-founder Vitalik Buterin had previously outlined the challenges associated with accelerating the proliferation of account abstraction functionality. This ambitious endeavor entails the introduction of an Ethereum Improvement Proposal (EIP) aimed at transforming EOAs into smart contracts and ensuring seamless compatibility with layer-2 solutions.