How native transaction assertions could enforce a transaction’s final outcome

The Ethereum Foundation, spearheading its ambitious Trillion Dollar Security initiative, has pinpointed a critical vulnerability in user interaction with the blockchain: the discrepancy between a user’s intended transaction and its actual outcome. This gap, often exploited through "blind signing" or leading to "transaction uncertainty," exposes users to substantial financial risk within the multi-trillion dollar decentralized finance (DeFi) ecosystem. To mitigate these threats, the Foundation is actively developing and proposing "native transaction assertions" – a novel mechanism designed to programmatically guarantee a transaction’s desired result directly on the blockchain. This initiative, first announced on May 14, 2025, alongside the Clear Signing announcement on May 12, 2026, represents a concerted effort to fortify the security posture of Ethereum, ensuring greater user protection and fostering broader adoption.

The Peril of Discrepant Outcomes: Why Signatures Aren’t Enough

The fundamental challenge stems from Ethereum’s execution model. While a user’s cryptographic signature irrevocably commits to a specific transaction request (target contract, value, and calldata), the Ethereum Virtual Machine (EVM) executes this request against the prevailing code and state at the moment of inclusion in a block. This critical distinction means that a valid signature, in itself, does not guarantee the desired or expected outcome. Users have regrettably incurred significant losses due to two primary types of mismatches:

1. Intent Mismatch: The user signs a transaction believing it performs one action, but the underlying data, often manipulated by a compromised frontend, dictates a completely different, malicious action.
2. Outcome Mismatch: The user signs the intended transaction, but external factors – such as changes in the blockchain’s state, liquidity shifts, or malicious frontrunning – lead to an undesirable or economically ruinous result that falls outside their acceptable parameters.

Recent high-profile incidents vividly illustrate these vulnerabilities. In the Bybit incident, attackers compromised a frontend to trick users into signing transactions that authorized the replacement of a Safe’s implementation contract, effectively handing over control. Similarly, the BadgerDAO attack saw users unwittingly grant attackers broad permissions to spend their tokens after interacting with a malicious interface. These cases underscore the danger where the displayed action diverges critically from the cryptographically signed data.

An outcome mismatch, while not involving a malicious alteration of the signed request itself, can be equally devastating. The Aave and CoW collateral swap incident serves as a stark example. A user initiated a swap of approximately $50.4 million in aEthUSDT for aEthAAVE. However, due to extremely thin AAVE liquidity and CoW’s gas ceiling rejecting more complex, safer quotes during verification, the transaction proceeded with a highly unfavorable exchange rate. Despite a 99.9% price impact warning displayed by the interface, the user proceeded, receiving only about $36,000 worth of tokens – a catastrophic loss of over 99% of the intended value. In all these scenarios, a crucial layer of trust was missing: an independent, on-chain rule that could verify the resulting state against the user’s explicit or implicit economic goals and security policies.

Currently, Ethereum lacks a generalized, native mechanism for on-chain code to comprehensively inspect the complete set of net state changes and emitted events produced by a transaction before finalizing its effects. This absence leaves a critical blind spot in the blockchain’s security architecture.

The Elusive Control: What a Signature Doesn’t Govern

A digital signature on Ethereum primarily validates the sender’s authorization of a specific calldata (function call and arguments), value (ETH transfer amount), and target address. However, the ultimate outcome is dynamically determined by several factors beyond the signature’s scope:

• EVM Execution Environment: The smart contract code and the blockchain’s state at the precise moment of transaction execution are paramount. These can evolve between the time a user signs a transaction and when it is finally processed and included in a block.
• Proxy Contracts: Many complex protocols utilize upgradeable proxy contracts. The implementation contract, which contains the actual logic, can be changed after a user signs a transaction but before it executes. This means the code that ultimately runs might differ from what the user initially inspected or intended to interact with.
• Transaction Ordering (MEV): The order in which transactions are included in a block can dramatically alter outcomes. For instance, a "sandwich attack" involves a malicious actor frontrunning a user’s swap transaction by buying up tokens, driving up the price, letting the user’s transaction execute at a worse price, and then backrunning it by selling the tokens at the newly inflated price. The user’s signed transaction remains unchanged, but its economic result is severely impacted.

The diagram below visually represents this dynamic, illustrating how the signed request, coupled with the prevailing code and state, collectively determines the transaction’s final outcome, often with unpredictable variations.

*(Imagine a diagram here showing "Signed Request" leading to "Code" and "State" which then together lead to "Outcome".)

Current Defenses: Necessary but Insufficient

The Ethereum ecosystem has developed several layers of defense, each offering some protection but falling short of a complete solution:

• Clear Signing: This crucial wallet feature, part of the broader Trillion Dollar Security initiative, aims to translate opaque calldata into human-readable actions, allowing users to understand what they are signing. However, its effectiveness relies on accurate decoding and the user’s ability to discern discrepancies between the displayed action and their true intent. It doesn’t protect against adverse outcomes from correct but ill-advised signings or state changes.
• Transaction Simulation: Wallets and dApps often simulate transactions against a selected chain state to predict their effects. While valuable, simulations are merely predictions. The actual chain state can change before inclusion, rendering the simulation’s results inaccurate. Furthermore, as seen in the Radiant Capital post-mortem, malware on a user’s machine can substitute a malicious payload at signing time, even if both the wallet interface and a simulation displayed the correct, intended transaction.
• Contract Checks and Wallet Guards: Smart contracts themselves, or external "guard" contracts (like those in Safe), can implement rules that revert a transaction if certain conditions are not met during EVM execution. For example, Uniswap reverts a swap if the output falls below a predefined amountOutMinimum. Safe’s checkAfterExecution hook allows a guard to inspect an account’s state post-execution. While powerful, these checks are limited:
  • They require predefined state variables to check.
  • They depend on other contracts exposing specific functions (e.g., balanceOf for token balances). A proxy might not expose its implementation address directly, preventing a guard from reading critical internal slots.
  • Crucially, these mechanisms cannot inspect the full set of net state changes. A guard can verify that a specific balance remains unchanged, but it cannot ask the EVM what else changed, leaving unmonitored effects to potentially go unnoticed.

These existing defenses, while vital, operate within a framework that doesn’t provide a holistic, on-chain guarantee of desired outcomes. They are reactive or limited in scope, highlighting the need for a more comprehensive, native solution.

Native Transaction Assertions: A Paradigm Shift in On-Chain Security

Native transaction assertions represent a significant architectural enhancement, designed to allow on-chain code to inspect the entire set of net state changes and events after a transaction’s primary actions have been executed. The core principle is simple yet profound: an assertion, defined by read-only logic, compares the blockchain’s state before and after a transaction against a predefined rule. If this rule is violated, the entire transaction’s actions are reverted, as if they never happened.

These assertions would be included in the transaction and cryptographically signed alongside its actions. This enables a powerful range of protections:

• Outcome Guarantees: Users could specify a minimum amount of tokens to be received from a swap, cap the total spending, prevent new token approvals, ensure an account’s control logic remains unchanged, or permit only a specified, limited set of state modifications.
• Independent Verification: The rule’s integrity is paramount. It must originate from an independently approved user intent, a standing account security policy, or robust protocol logic that cannot be tampered with by a compromised frontend or malicious intermediary. This ensures that the assertion itself acts as a trusted, immutable guardrail.

The diagram below illustrates this enhanced flow, showing how assertions act as a final gate, reverting the transaction if the rules fail.

*(Imagine a diagram here showing "Signed Request" -> "Actions" -> "Assertion Check (using Start State & Final State)" -> "Success" or "Revert Actions".)

Key Design Considerations: Shaping the Future of Transaction Safety

The development of native transaction assertions involves critical design choices regarding how the EVM exposes state information, how assertion code accesses it, and where these new opcodes can operate within the execution environment. These decisions directly influence the flexibility, security, and efficiency of the system:

• Information Scope: Should assertions inspect only state changes (balances, storage, code), only events, or both? A comprehensive solution would likely require access to both to provide a full picture of a transaction’s effects.
• Access Mechanism: How will assertion code query this information? Options include iterating through all changes, looking up specific values by address/slot, or copying the full set of changes into memory for more complex analysis.
• Execution Context: Should the assertion opcodes be restricted to specific transaction types (e.g., a new "assertion transaction" type) or specific execution phases (e.g., at the very end of a transaction), or be universally available throughout the EVM? Restricting their scope can enhance security and simplify implementation.

EIP-7906: A Concrete Proposal for Transaction Assertions

One leading proposal addressing these design challenges is EIP-7906, which builds upon the concept of "frame transactions" introduced in EIP-8141. EIP-8141, currently slated for inclusion in the Hegotá upgrade, defines a structured transaction type comprising an ordered sequence of validation and action steps. EIP-7906 extends this by adding a special, read-only POST_TX frame at the very end of the transaction execution. This POST_TX frame is specifically designed to house the assertion logic, allowing it to inspect the transaction’s outcome without introducing new state changes itself. EIP-7906 has advanced to "Considered for Inclusion" in future upgrades, marking it as a strong candidate for implementation.

The EIP-7906 design is notable for its comprehensive exposure of transaction data:

• State Changes: It reports net differences in native ETH balances and storage slots. Crucially, if a storage slot is written to multiple times but ultimately reverts to its original value, it will not appear in the final diff, providing a clean view of net effects. Newly deployed contracts and their code hashes are also exposed.
• Events: The design also includes access to all emitted events, allowing assertions to verify specific event patterns or data, which can be vital for certain protocol interactions.

To facilitate access to this information, EIP-7906 proposes three new EVM opcodes:

• TXTRACE: This opcode enables enumeration of all net state changes and events, allowing assertion logic to iterate through all modifications.
• TXDIFF: This opcode allows retrieval of the starting and final values for specific addresses and storage slots, providing targeted inspection capabilities.
• EVENTDATACOPY: This opcode facilitates copying an event’s data into memory for more detailed programmatic analysis within the assertion logic.

The POST_TX frame’s execution as a static call (read-only) is a critical security feature. It ensures that the assertion logic itself cannot accidentally or maliciously alter the blockchain state. If the assertion rule fails, the entire preceding execution body of the transaction is reverted. However, the transaction itself remains in the block with a failed status, and the gas payer is still charged for the consumed gas. This mechanism is vital for preventing denial-of-service attacks, where malicious actors might intentionally submit failing transactions to burden block builders without financial consequence.

Ensuring Efficacy: The Requirement for Assertions

A key consideration for the practical effectiveness of EIP-7906 is that it does not inherently require transactions to include an assertion. This means that, without additional safeguards, a malicious actor or a poorly designed interface could simply omit the assertion, circumventing the protection. Therefore, robust adoption hinges on external enforcement:

• Wallet Integration: For user-initiated transactions, wallets must be updated to ensure that every frame transaction they construct includes the necessary assertion. This assertion could be derived from a pre-run simulation, a user’s pre-configured standing security policy (e.g., "never approve spending more than X ETH," "only interact with these approved contract addresses"), or a combination thereof.
• Protocol Enforcement: Protocols that want to leverage transaction assertions for enhanced security must verify that incoming calls originate from frame transactions containing the exact required assertion. Such protected functions would need to reject ordinary transactions or frame transactions with missing or incorrect assertions. This presents a challenge for already deployed, immutable smart contracts, which cannot be retrofitted with this check. It implies that new contracts or upgradable proxies would be better positioned to adopt this feature.

Broader Implications and Future Horizons

Beyond the immediate security benefits for individual users and protocols, native transaction assertions unlock a range of powerful use cases that could fundamentally reshape how interactions occur on Ethereum:

• Enhanced Delegation: When users delegate authority to an agent (e.g., a bot, a multi-sig signer), assertions can add a crucial layer of control over the outcome of the agent’s actions, not just the actions themselves. Users could constrain not only what the agent is allowed to do (e.g., limiting contracts, spending caps, permission durations) but also what results those actions must produce (e.g., "ensure my balance of token X increases by at least Y").
• Protocol-Defined Safety Checks: Protocols could mandate specific safety checks for all callers utilizing frame transactions, ensuring a consistent level of security across all interactions. In solver-based execution models, protocols could specify the required outcome of a complex operation (e.g., a multi-step swap) while allowing the solver the flexibility to determine the optimal execution route. This guarantee, however, would currently be limited to a single transaction on a single network.
• Workflow Verification: Assertions could be used to confirm that multi-step workflows reach their intended final state, ensuring that unused tokens are returned, temporary approvals are revoked, and all intermediate conditions are met.
• Trustless Automation: By embedding outcome-based rules directly into transactions, assertions could facilitate more robust and trustless automation, reducing reliance on off-chain monitoring and potentially fallible human oversight.

The implementation of native transaction assertions marks a pivotal moment in Ethereum’s evolution, moving towards a more robust, user-centric security model. As the "Trillion Dollar Security initiative" continues to push the boundaries of on-chain safety, these innovations are poised to dramatically reduce financial risks, instill greater confidence in decentralized applications, and pave the way for a more secure and predictable Web3 future.

Community Engagement and Shaping the Design

The Ethereum Foundation emphasizes that the design of native transaction assertions remains an ongoing, collaborative process. Input from wallet developers, protocol teams, security researchers, and the broader community is actively sought to refine the proposals and ensure they meet the real-world needs of the ecosystem. Interested parties are encouraged to contribute to the research by contacting [email protected] or by joining the ongoing discussions on the EIP-7906 discussion thread on Ethereum Magicians. Further information on risk controls and priority work within the initiative can be found at trilliondollarsecurity.org. This collaborative approach is fundamental to building a more resilient and trustworthy Ethereum for all.