Ethereum’s Trillion Dollar Security Initiative Tackles Blind Signing and Transaction Uncertainty with Native Assertions.

The Ethereum Foundation’s ambitious Trillion Dollar Security initiative, launched on May 14, 2025, has identified "blind signing" and "transaction uncertainty" as critical user experience risks demanding immediate attention. In response, the initiative is actively exploring the implementation of native transaction assertions as a crucial next step to enforce the final outcome of a transaction, working in tandem with the previously announced Clear Signing standard from May 12, 2026. This forward-thinking approach aims to fundamentally enhance the security and predictability of user interactions within the Ethereum ecosystem, which currently secures hundreds of billions of dollars in digital assets and decentralized applications.

The Pervasive Threat of Misaligned Intent and Outcome

At the heart of the security challenge lies a fundamental characteristic of how Ethereum processes transactions: it executes precisely what is authorized by a signature, without inherent judgment on whether the resulting outcome aligns with the user’s intended goal. A user’s signature serves as a cryptographic commitment to a specific request, yet its final effect is heavily influenced by the prevailing contract code and network state at the moment of execution. This inherent disconnect has repeatedly led to significant financial losses for users, manifesting in two primary forms: an "intent mismatch," where users approve something different from what they believed, and an "outcome mismatch," where an intended request still yields an undesirable result.

The problem of intent mismatch gained widespread attention through incidents like the Bybit security event and the BadgerDAO attack. In the Bybit case, a compromised frontend tricked users into signing transactions that, unbeknownst to them, authorized the replacement of a critical Safe contract’s implementation. Similarly, the BadgerDAO attack saw users granting an attacker broad permissions to spend their tokens, again due to a malicious frontend presenting a fraudulent signing request. These incidents underscored the vulnerability of users to sophisticated phishing and supply chain attacks, where the visual representation of a transaction in a wallet might not accurately reflect the underlying calldata being signed.

The outcome mismatch, though less about malicious frontends, highlights another layer of complexity. The Aave and CoW collateral swap incident serves as a stark example. A user initiated a swap of approximately $50.4 million in aEthUSDT for aEthAAVE. However, the AAVE liquidity proved insufficient for a trade of that magnitude. Exacerbating the issue, CoW’s gas ceiling rejected more complex, potentially safer quotes during verification, leaving only one highly unfavorable option: roughly 329 aEthAAVE. Despite the interface prominently displaying a 99.9% price impact warning and requiring explicit confirmation of potential total loss, the user proceeded, receiving tokens valued at a mere $36,000. In this scenario, the signed request was technically what the user initiated, but the outcome was drastically different from any reasonable economic goal.

In each of these devastating cases, a critical safeguard was absent: a trusted, independently defined rule over the resulting state of the blockchain, enforced during transaction execution. For Bybit, such a rule could have prevented any unauthorized change to the Safe implementation. For BadgerDAO, it could have restricted new token approvals exclusively to verified Badger contracts. In the Aave example, a rule could have mandated a minimum acceptable output for the swap, independent of the volatile quote presented by the interface. The current Ethereum architecture, however, lacks a generalized, native mechanism for on-chain code to comprehensively inspect the full suite of net state changes and events produced by a transaction, leaving these critical gaps in user protection.

The Uncontrolled Variables of a Signed Transaction

A user’s cryptographic signature on Ethereum commits to a specific action: a target contract, an ETH value, and the calldata (the instructions for the contract). However, the Ethereum Virtual Machine (EVM) executes this call against the contract code and state present at the time of execution. This state can, and often does, change between the moment a user signs a transaction and when it is finally included in a block. Consequently, the resulting net balance and storage changes, along with any emitted events, can diverge significantly from what the user anticipated.

This dynamic is visually represented by the interaction of the signed request, the contract code, and the current state determining the final outcome. For instance, a target contract might utilize a proxy whose underlying implementation contract is swapped out before the transaction executes. This means the code that ultimately runs could be entirely different from what the user initially inspected and implicitly trusted. Furthermore, transaction ordering, heavily influenced by miner extractable value (MEV) and block builder strategies, can dramatically alter the state a call encounters. A classic example is a sandwich attack, where malicious actors can manipulate a liquidity pool’s price immediately before and after a user’s swap, without ever altering the user’s signed transaction itself, leading to unfavorable execution prices.

Limitations of Existing Security Measures

While the Ethereum ecosystem has developed various defenses against these risks, none offer a complete solution.

• Clear Signing: This crucial wallet feature aims to decode and present the user with a human-readable explanation of the action requested by the calldata. It significantly improves transparency by allowing users to verify the intent of the transaction. However, its effectiveness hinges on accurate decoding and the user’s ability to recognize when the decoded action deviates from their true intention. It does not, for example, protect against an outcome mismatch where the intended action yields an undesirable financial result due to market conditions or unexpected state changes.

• Transaction Simulation: Wallets and dApps frequently employ simulation tools, which predict a transaction’s effects by running it against a selected chain state (e.g., the current block or a pending block). While valuable for forecasting, simulations are not foolproof. The chain state can change before a transaction is actually included in a block, rendering the simulation’s prediction inaccurate. More critically, as seen in the Radiant Capital post-mortem, malware on a signer’s machine can substitute a malicious payload at the moment of signing, even if the wallet interface and its simulation correctly displayed the intended transaction. The simulation provides a snapshot, not an ironclad guarantee of the final on-chain reality.

  

• Contract Checks and Wallet Guards: On-chain mechanisms, such as contract-level checks and wallet guards, also provide a layer of defense during EVM execution. Uniswap, for instance, incorporates a amountOutMinimum parameter, reverting a swap if the actual output falls below this user-defined threshold. Safe (formerly Gnosis Safe) smart accounts utilize checkAfterExecution hooks, allowing a guard contract to inspect the account’s state post-transaction and revert if certain rules are violated. These approaches are powerful but have inherent limitations. They require defining which specific state changes to check in advance, and their ability to read another contract’s storage is often dependent on the functions that contract explicitly exposes. For example, while a token’s balanceOf function makes balance checks straightforward, a proxy contract might not expose its implementation address directly, preventing a guard from reading that critical implementation slot without a dedicated interface. Crucially, these existing checks cannot inspect the full set of net state changes. A guard can confirm a specific balance remains unchanged, but it cannot ask the EVM for a comprehensive list of everything else that changed, allowing unforeseen side effects to go unnoticed.

Introducing Native Transaction Assertions: A Paradigm Shift

Native transaction assertions represent a significant architectural enhancement designed to address these fundamental shortcomings. The core idea is to empower on-chain code to inspect the complete set of net state changes after a transaction’s primary actions have been executed. An assertion functions as read-only logic, comparing the blockchain’s state before and after the transaction against a predefined rule. If this rule is violated, the entire transaction’s actions are reverted, effectively preventing undesirable outcomes.

The assertion rule itself is included within the transaction and cryptographically signed alongside the transaction’s primary actions. This ensures that the user explicitly agrees to the conditions under which their transaction should succeed. These rules can be highly versatile, covering a wide range of parameters:

• Minimum output received: Ensuring a user gets at least a certain amount of tokens from a swap.
• Spending caps: Limiting the total value transferred or approved.
• Blocking new approvals: Preventing unauthorized token spending permissions.
• Preserving control logic: Ensuring a wallet’s implementation or ownership structure remains unchanged.
• Allowing only a specified set of changes: Defining an explicit whitelist of permissible state alterations.

This mechanism fundamentally shifts the security paradigm. Instead of relying solely on pre-execution checks or external simulations, assertions provide an ironclad, on-chain guarantee that a transaction will only finalize if its post-execution state conforms to predefined security and intent parameters.

However, the source of the assertion rule is paramount. A compromised frontend could theoretically inject a malicious assertion that permits an attack. Therefore, for assertions to be truly effective, the rule must originate from an independently approved user intent (e.g., explicitly confirmed by the user in a secure environment), a standing account policy (e.g., set by a smart contract wallet’s guardian), or robust protocol logic that cannot be tampered with by a compromised component.

EIP-7906: A Concrete Proposal for State Diff Opcodes

The design and implementation of native transaction assertions require careful consideration of several technical aspects: what information the EVM exposes, how assertion code accesses it, and where these new opcodes can operate. The information could encompass state changes, emitted events, or both. Access mechanisms could involve enumerating all changes, looking up specific values, or copying the full set of changes into memory. Furthermore, the new opcodes might be restricted to particular transaction types or execution phases, or allowed more broadly within the EVM.

One prominent solution under active development is EIP-7906, which builds upon the concept of "frame transactions" introduced in EIP-8141. EIP-8141, currently slated for inclusion in the upcoming Hegotá upgrade, defines a new transaction type that contains an ordered sequence of validation and action steps. EIP-7906 extends this by adding a read-only POST_TX frame at the very end of the transaction’s execution. This POST_TX frame is specifically designed to inspect the transaction’s final outcome. EIP-7906 has advanced to "Considered for Inclusion," indicating strong interest and potential for future integration.

The EIP-7906 design is comprehensive, exposing both net state changes and emitted events. State changes are reported as the net differences in native ETH balances and storage slots, along with any newly deployed contracts and their corresponding code hashes. Crucially, storage slots that are written to multiple times within a transaction appear as a single entry, showing only their starting and final values. If a storage slot ultimately reverts to its original value, it is not reported at all, optimizing for efficiency and relevance.

To facilitate access to this vital information, EIP-7906 proposes three new EVM opcodes (low-level instructions):

• TXTRACE: This opcode allows assertion logic to enumerate (iterate through) all net state changes and events generated by the transaction.
• TXDIFF: This opcode enables the retrieval of specific starting and final values for particular addresses and storage slots, offering precise lookup capabilities.
• EVENTDATACOPY: This opcode facilitates copying an event’s data into memory, allowing for detailed inspection of emitted events.

These powerful opcodes are strictly confined to operate only within a POST_TX frame. Furthermore, the POST_TX frame executes as a static call, meaning it cannot itself modify the blockchain state. This read-only restriction is critical for security, ensuring that the assertion logic cannot inadvertently (or maliciously) alter the transaction’s outcome. If an assertion rule within the POST_TX frame fails, the entire execution body of the transaction is reverted. However, the transaction itself remains in the block with a failed status, and the gas payer is still charged for the consumed gas. This crucial design choice prevents attackers from exploiting assertions to force block builders to execute deliberately failing transactions for free, which could otherwise be used as a denial-of-service vector.

The Imperative of Required Assertions

A critical consideration for the widespread efficacy of EIP-7906 is the question of whether assertions are mandatory. As currently designed, EIP-7906 does not inherently require transactions to include an assertion. This means that whoever constructs a transaction could, in principle, omit it, leaving users vulnerable.

Therefore, for transaction assertions to fulfill their promise, an ecosystem-wide shift is necessary. For individual user transactions, wallets must be mandated or strongly incentivized to ensure that every frame transaction they construct includes the appropriate, independently verified assertion. This rule could be generated from a simulation run by the wallet, or it could derive from a standing, pre-approved security policy applied universally to the user’s transactions.

For protocols, particularly those managing significant value or critical operations, a protected function would need to explicitly verify that any incoming call originates from a frame transaction containing the exact required assertion. Such a protocol would then reject ordinary transactions or frame transactions with missing or incorrect assertions. This necessitates that callers and integrating applications adopt compatible frame transactions. A key challenge here is that already deployed, immutable smart contracts would be unable to add this crucial check, highlighting a potential adoption hurdle for legacy systems.

Broader Implications and Future Use Cases

Beyond their primary role in bolstering user and protocol security, native transaction assertions unlock a spectrum of other transformative use cases:

• Strengthening Delegation: When users delegate control to an agent (e.g., a smart contract wallet or an EOA that is part of a multi-sig), they typically impose limits on which contracts can be interacted with, spending caps, and permission durations. Assertions could add an additional, powerful layer of control by allowing the delegator to define specific rules for the outcome of each transaction executed by the agent. This means constraining not only what the agent may do but also what its actions produce, offering unprecedented granular control and trust minimization.

• Protocol-Defined Safety Checks: A protocol could define a universal safety rule, requiring every caller using a frame transaction to adhere to the same critical safety checks. This would standardize security across all interactions with the protocol.

• Optimized Solver Execution: In complex DeFi scenarios involving solver-based execution (e.g., intent-based architectures), a protocol could specify a precise, desired outcome for a transaction while granting the solver the flexibility to choose the most efficient execution route. The assertion would then guarantee that regardless of the solver’s chosen path, the final state meets the protocol’s requirements. It’s important to note this guarantee would apply only within a single transaction on a single network, not across multiple chains.

• Workflow Integrity: Assertions could verify that multi-step workflows reach their intended final state, ensuring that unused tokens are returned to the user, and any temporary token approvals are revoked post-execution, enhancing overall user safety and financial hygiene.

Shaping the Future of Ethereum Security

The development of native transaction assertions is an ongoing, collaborative endeavor under the umbrella of the Ethereum Foundation’s Trillion Dollar Security initiative. This ambitious project underscores Ethereum’s commitment to continuous innovation in security, recognizing the ever-evolving threat landscape and the increasing value entrusted to the network.

The success of these advancements hinges on broad community input and collaboration. The Ethereum Foundation actively seeks engagement from wallet developers, DeFi protocol teams, security researchers, and all stakeholders who would benefit from or contribute to these vital security enhancements. Interested parties are encouraged to reach out directly at [email protected] to explore specific use cases, contribute to the research, and help shape the design of these critical infrastructure improvements. Further engagement is also welcomed on the EIP-7906 discussion thread on Ethereum Magicians.

For a deeper dive into the risk controls and priority work being undertaken, the trilliondollarsecurity.org website serves as a central hub for information and updates, reflecting the collective effort to secure the future of decentralized finance and the broader Ethereum ecosystem. As Ethereum continues to mature and scale, foundational security primitives like native transaction assertions will be indispensable in fostering trust, driving adoption, and safeguarding the immense value it represents.