Fireblocks, a company specializing in cryptocurrency infrastructure, has identified and assisted UniPass Wallet in addressing an ERC-4337 account abstraction vulnerability issue.
An October 26 announcement revealed an ERC-4337 account abstraction vulnerability in the UniPass smart contract wallet. The vulnerability was reportedly discovered in hundreds of mainnet wallets during a white-hat hacking operation. The two companies collaborated to resolve the flaw.
According to Fireblocks, the vulnerability would permit an attacker to acquire complete control of the UniPass Wallet by manipulating Ethereum’s account abstraction process.
According to Ethereum’s developer documentation on ERC-4337, account abstraction enables a shift in how the blockchain processes transactions and smart contracts, allowing for greater flexibility and efficiency.
Transactions on Ethereum typically involve two account types: externally owned accounts (EOAs) and contract accounts. EOAs are governed by private keys and can initiate trades, whereas the smart contract’s code governs contract accounts. When an EOA transmits a transaction to a contract account, it executes the contract.
Account abstraction introduces the concept of a meta-transaction or abstracted accounts with a broader scope. Removed accounts, like EOAs, are not associated with a particular private key and can initiate transactions and interact with smart contracts.
As explained by Fireblocks, when an ERC-4337-compliant account executes an action, it relies on the Entrypoint contract to guarantee that only signed transactions are carried out. Before conducting a command, these accounts typically rely on a single audited EntryPoint contract to ensure they have permission from the account:
“It’s important to note that a malicious or buggy entrypoint could, in theory, skip the call to “validateUserOp” and just call the execution function directly, as the only restriction it has is that it’s called from the trusted EntryPoint.”
According to Fireblocks, the flaw allowed an attacker to take control of UniPass wallets by substituting the trusted EntryPoint. After completing the account takeover, an attacker could access the wallet and deplete its funds.
Several hundred users whose wallets had the ERC-4337 module enabled were susceptible to the attack, which could be carried out by any actor on the blockchain. The wallets in question contained only modest sums of money, and the problem was resolved early.
After determining that the vulnerability was exploitable, the research team at Fireblocks was able to conduct a white-hat operation to patch the extant vulnerabilities. This required the true exploitation of the vulnerability:
“We shared this idea with the UniPass team, who took it upon themselves to implement and run the whitehat operation.”
Vitalik Buterin, co-founder of Ethereum, has previously enumerated obstacles to accelerating the spread of account abstraction functionality, including the need for an Ethereum Improvement Proposal (EIP) to transform EOAs into smart contracts and ensure that the protocol is compatible with layer-2 solutions.
