How native transaction assertions could enforce a transaction’s final outcome

This pivotal development marks a significant step in the Ethereum ecosystem’s ongoing efforts to enhance user protection and solidify its position as a secure and reliable platform for decentralized applications. The initiative, announced as part of a broader commitment to securing the vast sums of capital flowing through the network, directly addresses fundamental vulnerabilities that have led to substantial financial losses for users. By focusing on native transaction assertions, the Ethereum Foundation aims to provide a robust, on-chain mechanism to ensure that the actual outcome of a transaction aligns precisely with the user’s intended outcome, even in the face of sophisticated attacks or unforeseen state changes.

The Genesis of the "Trillion Dollar Security" Mandate

Ethereum, with a market capitalization often exceeding a trillion dollars and a Total Value Locked (TVL) in decentralized finance (DeFi) protocols regularly in the hundreds of billions, presents an attractive target for malicious actors. The sheer scale of value managed by smart contracts underscores the critical need for advanced security measures. The "Trillion Dollar Security" initiative, officially launched on May 14, 2025, reflects this imperative, signaling a dedicated, multi-faceted approach to fortify the network’s defenses. It acknowledges that while cryptographic signatures secure the authorization of a transaction, they do not inherently guarantee its outcome. This distinction is crucial, forming the bedrock of the challenges that native transaction assertions seek to overcome.

Unpacking Transaction Risks: Blind Signing and Outcome Uncertainty

The core problem stems from the inherent design of the Ethereum Virtual Machine (EVM). The EVM executes precisely what is authorized by a user’s signature, without an intrinsic understanding or validation of the user’s desired end-state. A signature commits to a specific request – a target contract, value, and calldata – but the ultimate result is dynamically determined by the contract’s code and the prevailing network state at the moment of execution. This separation creates two primary vectors for unintended outcomes:

1. Intent Mismatch (Blind Signing): This occurs when users sign a transaction believing it will perform one action, but it secretly executes another. This is often facilitated by "blind signing," where the user’s wallet displays only a hexadecimal hash of the transaction data, obscuring the actual operation. Malicious frontends or malware can substitute legitimate transaction data with a malicious payload, which the user then unknowingly signs.

   • Case Study: Bybit Incident (Approx. 2023): In this notable event, a compromised frontend allegedly tricked users into approving a transaction that replaced the implementation contract of a Safe (formerly Gnosis Safe) multisig wallet. Signers, believing they were performing a routine operation, unwittingly authorized a critical change to the wallet’s underlying logic, potentially granting attackers control over significant assets.
   • Case Study: BadgerDAO Attack (December 2021): The BadgerDAO attack saw approximately $130 million stolen after a malicious script was injected into the project’s website. Users interacted with the compromised frontend, which generated requests granting the attacker permission to spend their deposited tokens. Despite appearing legitimate on the surface, the underlying transaction had been altered to siphon funds.

2. Outcome Mismatch (Transaction Uncertainty): Here, the user signs the intended request, but external factors or the state of the blockchain at execution time lead to an undesirable outcome. The transaction executes as authorized, but the result conflicts with the user’s economic goals or safety policies.

   • Case Study: Aave and CoW Collateral Swap (Approx. 2024): A user attempted to swap a substantial sum – about $50.4 million of aEthUSDT for aEthAAVE. However, the AAVE liquidity pool was critically shallow for a trade of that magnitude. Exacerbating the issue, CoW Protocol’s gas ceiling rejected more complex (and likely more efficient) quotes during verification, leaving a single, highly unfavorable quote for roughly 329 aEthAAVE. Despite a prominent 99.9% price impact warning and explicit confirmation from the user, the transaction proceeded, resulting in the user receiving tokens worth only about $36,000, a devastating loss of nearly 100% of the principal.

These incidents highlight a critical gap: the absence of a trusted, on-chain mechanism to define and enforce rules over the resulting state of a transaction, independent of the transaction builder or the executing code. For instance, in the Bybit case, a rule could have dictated that the Safe implementation contract must remain unchanged. For BadgerDAO, assertions could have restricted new token approvals only to officially published Badger contracts. The Aave user could have benefited from a rule specifying a minimum acceptable output, preventing such extreme slippage.

The EVM’s Blind Spot: What a Signature Doesn’t Control

The fundamental challenge lies in the dynamic nature of the Ethereum blockchain. A user’s signature commits to a specific action, but the execution environment is fluid:

• Code Changes: Many smart contracts utilize upgradeable proxy patterns. The implementation contract pointed to by a proxy can be changed after a transaction is signed but before it is executed. This means the code that ultimately runs might differ significantly from what the user initially inspected and implicitly trusted.
• State Changes and Transaction Ordering: The state of the blockchain—account balances, contract storage, token prices—is constantly evolving. The order in which transactions are included in a block can dramatically alter the outcome. For example, a "sandwich attack" can manipulate a decentralized exchange (DEX) pool’s price immediately before and after a user’s swap, leading to significant financial losses due to front-running or back-running, even though the user’s signed transaction remains unchanged.

The diagram illustrating how the signed request, code, and state determine the outcome vividly demonstrates this disconnect, underscoring the limitations of relying solely on pre-execution checks.

Current Defenses: Necessary but Insufficient

Existing security measures have certainly improved the user experience but fall short of providing comprehensive protection against all forms of intent and outcome mismatch:

• Clear Signing: This initiative aims to improve wallet interfaces by providing human-readable explanations of what a transaction’s calldata requests. It’s a crucial step in combating blind signing by making transactions transparent. However, its effectiveness relies on accurate decoding and the user’s ability to discern discrepancies between the displayed action and their intent. It doesn’t, however, protect against malicious state changes or unexpected outcomes that occur during execution.
• Transaction Simulation: Wallets and security services often simulate transactions against a selected chain state to predict their effects. While valuable, simulations are merely predictions. The actual chain state can change before a transaction is included in a block. Furthermore, sophisticated malware, as seen in the Radiant Capital incident (February 2023), can substitute a malicious payload at the signing stage, even if the wallet interface and initial simulation correctly showed the intended transaction. The user’s machine, not the blockchain, becomes the point of compromise.
• Contract Checks and Wallet Guards: These are on-chain rules enforced during EVM execution. Uniswap, for example, allows users to specify an amountOutMinimum to revert swaps with excessive slippage. Safe wallets utilize a checkAfterExecution hook, enabling a guard contract to inspect the account’s state post-execution and revert transactions that violate predefined rules. While powerful, these approaches have limitations:
  • They require defining which specific state variables to check in advance.
  • They depend on the target contract exposing functions to read its storage. For instance, while a balanceOf function makes balance checks easy, a proxy contract might not expose its implementation address, making it impossible for a guard to directly read the implementation slot.
  • Crucially, these checks cannot inspect the full set of net state changes produced by a transaction. A guard can verify if a specific balance is unchanged, but it cannot ask the EVM "what else changed?" This means unintended side effects, not explicitly anticipated by the guard’s design, can go unnoticed and unblocked.

Native Transaction Assertions: A New Frontier in On-Chain Security

Native transaction assertions represent a paradigm shift, offering a foundational solution by allowing on-chain code to inspect the entire set of net state changes after a transaction’s actions have run. An assertion functions as a read-only logic gate: it compares the starting and final values of state elements against a predefined rule. If this rule fails, the entire transaction, including its actions, is reverted.

Key characteristics and capabilities of native transaction assertions:

• Comprehensive Scope: Assertions can cover net changes to ETH balances, contract storage, code changes (e.g., new contract deployments or proxy upgrades), and even emitted events.
• Flexible Rule Definition: Users or protocols can define rules such as:
  • Requiring a minimum amount of tokens received in a swap.
  • Capping maximum spending.
  • Blocking new token approvals.
  • Preserving an account’s control logic (e.g., ensuring a Safe’s implementation address remains unchanged).
  • Allowing only a specified, whitelisted set of changes.
• Reversion Mechanism: If an assertion rule is violated, the transaction’s actions are reverted, effectively preventing the undesirable outcome.
• Independent Rule Source: Critically, the source of the rule matters immensely. A compromised frontend could theoretically inject a malicious assertion that permits an attack. Therefore, a truly effective rule must originate from an independently approved user intent (e.g., explicitly confirmed by the user in a secure environment), a standing account policy (defined by the user’s wallet or smart contract account), or robust protocol logic that cannot be manipulated by a compromised interface.

The second diagram vividly illustrates this process: actions run, then assertions check the outcome, reverting the transaction if rules fail, thereby enforcing the desired end-state.

Design Choices: Shaping the Future of Assertions

The development of native transaction assertions involves intricate design decisions that will shape their utility and integration into the EVM:

1. Information Exposure: What specific information should the EVM expose to assertion logic? This includes state changes (balance, storage, code), events, or both. A comprehensive solution would likely expose a wide array of data to maximize flexibility.
2. Access Mechanism: How will assertion code access this information? Options include:
   • Enumeration: Iterating through all changed entries.
   • Lookup: Querying specific values for particular addresses or storage slots.
   • Copying: Copying the full set of changes into memory for more complex processing.
3. Execution Context: Where within the EVM’s execution flow can these new opcodes run? Restricting them to specific transaction types or execution phases (e.g., a post-transaction hook) could enhance security and gas efficiency, while allowing them anywhere might offer greater flexibility but introduce complexity.

EIP-7906: A Concrete Proposal for State Diff Assertions

One leading proposal addressing native transaction assertions is EIP-7906 (Transaction Assertions via State Diff Opcode). This EIP builds upon EIP-8141 (Frame Transactions), which is slated for inclusion in the upcoming HegotÁ network upgrade. EIP-8141 introduces a new transaction type that allows for an ordered sequence of validation and action steps within a single transaction.

EIP-7906 extends this by adding a read-only POST_TX frame at the very end of the transaction’s execution. This POST_TX frame is specifically designed to check the transaction’s final outcome. While EIP-8141 is confirmed for HegotÁ, EIP-7906 has advanced to "Considered for Inclusion," indicating strong interest and progress, but its final confirmation for HegotÁ is still pending.

Key features of EIP-7906:

• Exposed Information: It exposes both state changes and events. State changes are reported as net differences in native ETH balances and storage. This means if a storage slot is written to multiple times but ultimately reverts to its original value, it won’t appear as a change. Newly deployed contracts and their code hashes are also reported.
• New Opcodes: Three new EVM instructions (opcodes) are introduced to facilitate access to this information:
  • TXTRACE: Enumerates all net state changes and emitted events.
  • TXDIFF: Retrieves the starting and final values for specific addresses and storage slots.
  • EVENTDATACOPY: Copies the data of a specific event into memory.
• Restricted Execution: These opcodes are designed to work exclusively within the POST_TX frame, which executes as a static call. This crucial restriction ensures that the assertion logic itself cannot modify the state, acting purely as an inspector and validator.
• Reversion and Gas Costs: If an assertion rule within the POST_TX frame fails, the entire execution body of the transaction is reverted. However, the transaction itself remains in the block with a failed status, and the gas payer is still charged for the consumed gas. This mechanism is vital to prevent attackers from exploiting assertions to force builders to execute deliberately failing transactions for free, which could otherwise be used for denial-of-service attacks.

The Indispensable Requirement: Assertions Must Be Mandatory

The efficacy of EIP-7906, and native transaction assertions in general, hinges on one critical factor: they must be required. If a transaction builder can simply omit an assertion, its protective benefits are nullified.

• User Transactions: For a user’s own transactions, the wallet plays a pivotal role. It must be designed to ensure that every frame transaction it constructs includes the necessary assertion. This assertion could be dynamically generated based on a simulation the wallet performs, or it could derive from a standing, user-defined policy that applies to all outgoing transactions.
• Protocol Interactions: For protocols, enforcing assertions is more complex. A protected function within a smart contract would need to verify that an incoming call originates from a frame transaction that contains the exact, required assertion. It would need to reject both ordinary transactions and frame transactions with missing or incorrect assertions. This implies that callers and integrated applications would need to adopt compatible frame transactions. A significant challenge here is that already deployed, immutable smart contracts cannot retroactively add this check, limiting immediate widespread adoption without upgrades or wrapper contracts.

Broader Implications and Transformative Use Cases

Beyond bolstering core security, native transaction assertions unlock a range of powerful new use cases:

• Enhanced Delegation: When users delegate authority to an agent (e.g., a bot or another smart contract) to act on their behalf, assertions can provide granular control over outcomes. While existing delegation mechanisms can limit which contracts an agent uses, how much it spends, or the duration of its permissions, assertions add a layer of outcome-based constraint. Users can now define rules not just for what the agent may do, but also for what its actions produce.
• Protocol-Defined Safety Checks: Protocols can define their own mandatory safety checks, requiring every caller using a frame transaction to adhere to them. This ensures a consistent level of security and adherence to protocol rules, regardless of the user interface or client.
• Optimized Solver Execution: In complex decentralized exchanges or settlement protocols that employ "solvers" (third-party entities that find optimal transaction routes), assertions can empower the protocol to specify the required outcome (e.g., minimum output tokens) while granting the solver freedom to choose the most efficient route. This guarantees user safety without sacrificing flexibility. It’s important to note, however, that this guarantee would typically apply only within a single transaction on a single network, not across multi-chain operations.
• Workflow Integrity: Assertions can verify that multi-step workflows reach their intended final state. For example, they could ensure that any unused tokens are returned to the user, or that temporary token approvals granted during a complex interaction are revoked post-execution. This reduces lingering attack surfaces and enhances overall transaction hygiene.

Shaping the Future: A Call to Action

The development of native transaction assertions is a cornerstone of the Ethereum Foundation’s "Trillion Dollar Security" initiative, representing a proactive and fundamental approach to securing the future of decentralized finance. These solutions are still in their design and refinement phases, emphasizing the importance of community input.

The Ethereum Foundation is actively seeking engagement from wallet providers, protocol teams, and security researchers who would be the primary users and beneficiaries of these advancements. Collaboration is crucial to explore diverse use cases, refine the design choices, and ensure that the proposed solutions are practical, effective, and widely adoptable. Interested parties are encouraged to reach out to [email protected] to contribute to the research and development efforts, or to join the ongoing discussions on the EIP-7906 discussion thread on Ethereum Magicians (ethereum-magicians.org/t/eip-restricted-behavior-transaction-type/23130).

By addressing the core issues of blind signing and transaction uncertainty with native, on-chain assertions, Ethereum aims to provide an unprecedented level of security and predictability for its users, paving the way for even greater trust and adoption in the decentralized future. More information on risk controls and priority work can be found at trilliondollarsecurity.org.