jakiro
>Source: Metacat
EIP-3074 United author is here!Before things became more out of control, let me temporarily calm this worry.
First of all: I did not hear that there are any wallets at present, supporting the signing without prefix data.This means that there is no wallet that supports EIP-3074.No matter how many control panels you browse or how many advanced features you open.The news that cannot be signed by EIP-3074Essence
The message of “logging in” DAPP uses the standard based on the EIP-3074 standard based on EIP-191EssenceThis will add the following data to the message of your signature:
This is why people who cannot deceive the login DAPP actually signed a valid Ethereum transaction.
The transaction uses a single byte value as a prefix:
0x02 -1559 TX
0x03-4844 TX
For more information, see: https://github.com/ethereum/execution-specs/tree/master/lists/signature-types
EIP-3074 plans to use prefix 0x04EssenceThis will eliminate the ambiguity of all other types of signature data in Ethereum.Wallets must actively choose to allow users to sign these messagesEssence
Based on the specific way of eip-3074, the situation of the wallet may cause users to be more likely to be used.EssenceTo understand this, we need to ensure that ourselves understand the working principle of EIP-3074 signature.
Establishing a signature authentication message has the following fields.The important thing is that it includes an address.This is the only address of AUTH that the signature is effective.
For accounts that consume the balance,mustAt the same time, satisfy the following two points:
1) Wallets need to be allowed to sign to any caller address (Invoker Address),
2) Users must not verify whether the invocator is credible.
This means that any of the users execute any of them.
We want the wallet software to understand:EIP-3074 caller (Invoker) is more similar to the extension of wallet software code instead of contractsEssenceWallets do not allow users to run any code freely and access their PK (private keys); similarly, they should not allow users to commission their Ethereum account at arbitrarily.
Therefore, if the wallet software integrates EIP-3074 unsure,andIf users do not verify that they are interacting, they may entrust to malicious callants.However, it can still be revoked by sending a single TX from EOA.This will revoke all the “ongoing” auth signatures.
At least, the wallet software should make the signing of the EIP-3074 message becoming a major event, just like exporting your private key level.
Suppose that the wallet is integrated with 3074 safely, the account may still be stolenEssenceThis is the basic attribute of batch transactions.It allows you to easily send multiple operations, just like it allows attackers to seduce you to send a batch of assets to the addresses they control.
Wallet software must clearly show every operation you are signingEssenceIn this way, it is easy to notice that “I only plan to deal with one transaction, but this signature request has made me more than a dozen transactions.”If it is approved by Blind Signing, this cannot be detectedEssence
Yes, EIP-3074 trusts wallets very much.However, we have trusted them safely with our private key!There is no higher level of trust.
Can be safely integrated and using EIP-3074.If any wallet has doubts about how to perform this operation, please contact us at any time.As the author of EIP-3074, we are currently considering how to help the next stage of development.
In the past few years, we have spent a lot of time to develop hypothetical scenes about how to use and abuse it.We are glad to start production.But we also realize that this is the most difficult part.
Summarize after EIP-3074, a single wrong signature will exhaust your concerns about your Ethereum account balanceThe
-The wallet does not support the signatures of the EIP-3074 type. The signature follows the new format.
-The unit field in the EIP-3074 signature is very important.A bad caller may steal your funds.
-The wallet needs to ensure that the address is credible.This is similar to how wallets are currently preventing any code.
-The batch transactions in EIP-3074 will still start a world, and malicious actors can deceive you to sign transactions to transfer assets.Wallets need to clearly show what happens when signing the EIP-3074 message.
-You, we have a high trust in wallets, but users have entrusted their private keys to them, which is the highest level of trust.
EIP-3074 and EIP-4337
EIP-3074 is a very good thing for providers of account abstraction, because it is very beneficial to our customers.
-ERC-4337 is the best way to introduce new users into the encryption field.
-EIP-3074 is the best way to introduce existing users into smart accounts.
Original link: https://twitter.com/lightClients/status/1778823652584120497
EIP-3074 will be launched in the next Ethereum hard fork.
