|
gm Bankless Nation,
Ethereum is still building for its users. In today's issue, our very own William M. Peaster fills in for David and discusses the latest "Clear Signing" innovation looking to bring self-custodying Ethereum users more protection against attackers. Thanks for being a subscriber,
luma 🫡
Sponsor: MetaMask - Trade prediction markets on mobile, powered by Polymarket.
. . .
TACTIC
Ethereum's Fix for Blind Signing
Hardware wallets can be one of the best ways to bolster your crypto security. They hold your private keys "cold," i.e. offline, so hackers can't directly swipe them. However, these devices aren't a panacea. Attackers can still trick you into signing something nefarious, like sending all your ETH to their address. The main vector for these sorts of deceptions to date? Blind signing. The first hardware wallets started around basic transfers that were straightforward to display. In recent years, the rise of complex smart contracts, e.g. Ethereum DeFi and NFTs, made it hard for wallets to decode transactions into readable text. Wallets turned to letting users sign these transactions "blindly," i.e. without knowing what's actually being approved, for practicality. The problem is that hackers can infect your computer or compromise an app frontend and thus make it look like you're signing a harmless transaction, while in actuality it's an approval for some theft scheme. So blind signing began as a practical shortcut, but it's evolved into a systemic vulnerability across the crypto ecosystem and played a key role in the hacks of projects like Bybit (~$1.5B), WazirX (~$230M), and Radiant Capital (~$50M). These kinds of heists will absolutely continue to creep up so long as blind signing remains open as a pressure point for advanced persistent threats like Lazarus Group. Fortunately, though, the end of the blind signing era is now officially coming into focus.
That's because this week the Ethereum Foundation's Trillion Dollar Security Initiative and a working group of crypto companies (Ledger, Trezor, Fireblocks, WalletConnect, etc.) debuted Clear Signing, a new open standard designed to make human-readable transactions the default on Ethereum. Central to this effort is ERC-7730, a shared format that lets protocols readily describe what their transactions actually do in plain language. In other words, a team can write a JSON descriptor that assigns readable fields to raw contract calls, and then they can publish this descriptor to an open registry stewarded by the Ethereum Foundation. Wallets then fetch from this registry as needed, allowing users to know exactly what they're being asked to sign.
Notably, Ledger is already live with Clear Signing support, and so far more than 40 protocols have published descriptors to the ERC-7730 registry, including DeFi heavyweights like Aave, Lido, Uniswap, and Safe. Of course, this registry is open and permissionless, so we'll likely see attestations emerge here, and wallets will be the final decider of which sources they accept before rendering anything. Needless to say, at a time when crypto hacks are on the rise, this initiative is a very welcome effort. User education simply can't overcome blind signing because the threat vector it opens up is a structural problem. To this end, Clear Signing is the structural fix, so it'll be nice to see the ERC-7730 registry's coverage steadily widen. Cheers to that!
FRIEND & SPONSOR: METAMASK
Trade the outcomes of real-world events across sports, politics, crypto, finance, all on mobile—with prediction markets on MetaMask, powered by Polymarket. No KYC, total self-custody, and simple two-tap trades.
. . .
WHAT YOU MISSED
Privacy Pools v2
📈 The Asset
🏛️ The Protocol
📱 The Apps
🤫 The Privacy Stack
🐸 The Culture
💻 The Tech
. . .
WEEKLY ROLLUP
Is the Bull Back?
Markets are ignoring every warning sign as stocks hit new highs, but crypto may finally have its catalyst.
Ryan and David break down the CLARITY Act’s key vote, Wall Street’s Ethereum push, Bitcoin’s $80K test, and why private AI stocks are creating chaos onchain.
Tune into this week’s Rollup! 👇
|
No comments:
Post a Comment