Ethereum’s Trillion Dollar Security Initiative Targets Blind Signing and Transaction Uncertainty with Native Transaction Assertions

The Ethereum Foundation’s ambitious Trillion Dollar Security initiative has spotlighted blind signing and transaction uncertainty as critical user experience risks, heralding a new era of on-chain protection. In response, the Foundation is actively exploring the implementation of native transaction assertions, a groundbreaking mechanism designed to enforce the final outcome of a transaction, working in tandem with the previously announced Clear Signing protocol. This development marks a significant stride towards fortifying the integrity of on-chain interactions, aiming to safeguard users from malicious attacks and unintended consequences within the vast and rapidly expanding Ethereum ecosystem, which currently commands a market capitalization well into the hundreds of billions and billions of dollars in Total Value Locked (TVL).

The core challenge stems from the inherent nature of how transactions are processed on Ethereum. A digital signature commits a user to a specific request, but the actual outcome of that request is dynamically determined by the smart contract code and the prevailing state of the blockchain at the moment of execution. This separation creates a critical vulnerability: users can sign what they believe to be a harmless or beneficial transaction, only for it to yield an entirely different, often detrimental, result. Experts categorize these discrepancies into two primary forms: intent mismatch and outcome mismatch, both of which have led to substantial financial losses across the decentralized finance (DeFi) landscape.

Understanding the Vulnerability: The "Blind Signing" and "Transaction Uncertainty" Challenge

Intent mismatch occurs when a user approves a transaction that, unbeknownst to them, differs from their intended action. This is frequently facilitated by compromised frontends or sophisticated phishing attacks that manipulate the transaction data presented to the user. When a user "blind signs," they are typically approving a cryptographic hash of the transaction data without fully understanding the underlying parameters or the specific actions the smart contract will execute. The wallet might display a simplified or misleading interpretation, or in worst-case scenarios, malicious code replaces the legitimate transaction data with an attacker’s payload just before signing.

Outcome mismatch, conversely, arises when a user signs a transaction they genuinely intend, but external factors or unforeseen state changes on the blockchain lead to an undesirable or economically damaging result. This could be due to extreme market volatility, insufficient liquidity for a large trade, or manipulative practices like sandwich attacks, where malicious actors front-run and back-run a user’s transaction to profit from price slippage. In such cases, the signed request itself is valid, but the conditions under which it executes render the outcome far from the user’s expectations.

Case Studies: High-Profile Incidents Underscore Urgency

Several high-profile incidents vividly illustrate the catastrophic potential of these vulnerabilities, collectively accounting for millions in lost assets and highlighting the urgent need for enhanced security mechanisms.

In the Bybit incident (circa 2023), a compromised frontend reportedly led signers to authorize the replacement of a Safe (formerly Gnosis Safe) wallet’s implementation contract. Users believed they were executing routine operations, but the underlying signing request had been tampered with, allowing an unauthorized contract to gain control over significant assets. This exemplifies a classic intent mismatch, where the user’s signature was valid for a malicious action they did not intend.

Similarly, the BadgerDAO attack (December 2021) saw attackers compromise the platform’s frontend, injecting malicious code that prompted users to unknowingly grant the attacker permission to spend their deposited tokens. Users, interacting with what appeared to be the legitimate BadgerDAO interface, executed what they thought were standard approvals, only to find their funds siphoned away. This incident resulted in losses exceeding $120 million, further underscoring the dangers of blind signing when frontend integrity is compromised.

An instance of outcome mismatch was observed in the Aave and CoW collateral swap (May 2023). A user attempted to swap approximately $50.4 million worth of aEthUSDT for aEthAAVE. However, the AAVE liquidity pool was exceptionally thin for such a large trade. Compounded by CoW Swap’s gas ceiling rejecting more complex, efficient quotes during verification, the transaction proceeded with a highly inefficient route, resulting in the user receiving only about 329 aEthAAVE, valued at roughly $36,000. Despite the interface displaying a 99.9% price impact warning, the user proceeded, highlighting how even explicit warnings might not prevent undesirable outcomes without robust on-chain enforcement.

In each of these scenarios, a fundamental lack of a trusted, on-chain mechanism to verify the actual resulting state against a user’s or protocol’s predefined rules was evident. For Bybit, a rule enforcing the immutability of the Safe implementation would have prevented the attack. For BadgerDAO users, a rule restricting new token approvals to only verified Badger contracts would have offered protection. The Aave user could have benefited from a minimum acceptable output assertion, calculated independently of the frontend’s quote, to ensure their economic goal was met.

Limitations of Existing Security Measures

While the Ethereum ecosystem has developed several layers of defense, none comprehensively address the full spectrum of intent and outcome mismatches:

• Clear Signing: This vital mechanism aims to explain the human-readable action requested by the transaction’s calldata. However, its effectiveness relies heavily on the accuracy of the decoding process and the user’s ability to recognize discrepancies. It primarily tackles intent mismatch at the interpretation level, but cannot prevent outcomes distorted by subsequent state changes.
• Transaction Simulation: Wallets and dApps often provide simulations, predicting a transaction’s effects based on a selected chain state. While helpful, simulations are inherently predictive and can be inaccurate. The chain state can change between simulation and actual inclusion in a block, or, as tragically demonstrated in the Radiant Capital incident (January 2023, where malware on a signer’s machine substituted a malicious payload at signing time despite a correct simulation), the signed transaction itself can differ from the one simulated.
• Contract Checks and Wallet Guards: Protocols like Uniswap implement checks (e.g., amountOutMinimum for swaps) that revert transactions if certain conditions are not met. Similarly, Safe’s checkAfterExecution hook allows guards to inspect an account’s state post-execution. While valuable, these defenses are limited. They require predefined checks on specific state variables and depend on contracts exposing functions to read their storage. Critically, they cannot inspect the full set of net state changes produced by a transaction, allowing unnoticed effects to persist. For instance, a guard can verify a specific balance remains unchanged but cannot ask the EVM what else changed across the entire state tree.

Introducing Native Transaction Assertions: A Paradigm Shift in On-Chain Security

Native transaction assertions represent a significant architectural enhancement, designed to bridge these gaps by allowing on-chain code to inspect the entire set of net state changes after a transaction’s actions have been executed. An assertion functions as a read-only piece of logic that compares the initial and final values of relevant state components against a predefined rule. If this rule is violated, the entire transaction is reverted, effectively preventing the undesirable outcome.

Crucially, the assertion rule is included within the transaction itself and signed alongside its primary actions. This ensures that the user’s or protocol’s security guarantees are an integral, cryptographically enforced part of the transaction. The scope of these assertions is comprehensive, capable of covering net changes to Ether balances, contract storage, contract code, newly deployed contracts, and even emitted events. This allows for highly granular control, enabling rules such as:

• Requiring a minimum amount of tokens received in a swap.
• Capping the maximum amount of tokens spent.
• Blocking new token approvals to unauthorized addresses.
• Preserving an account’s control logic (e.g., preventing a proxy implementation upgrade).
• Allowing only a specified, whitelisted set of state changes.

The power of assertions lies not just in the check itself, but in the source of the rule. For an assertion to be truly effective, it must originate from an independently approved user intent, a standing account policy, or robust protocol logic that cannot be manipulated by a compromised frontend or malicious builder. This "source of truth" ensures that the assertion reliably reflects the user’s or protocol’s security requirements.

EIP-7906: A Concrete Proposal for Implementation

One leading proposal for implementing native transaction assertions is EIP-7906 (Transaction Assertions via State Diff Opcode). This Ethereum Improvement Proposal builds upon the concept of "frame transactions" introduced in EIP-8141, which defines a new transaction type capable of containing an ordered sequence of validation and action steps.

EIP-7906 extends this framework by adding a specialized, read-only POST_TX frame that executes at the very end of the transaction’s lifecycle. This POST_TX frame is specifically designed to check the transaction’s outcome against the included assertions. The design of EIP-7906 is meticulously crafted to expose both state changes and events to the assertion logic. State changes are reported as "net differences" – for instance, if a storage slot is written to multiple times, only its starting and final values are reported. If a slot reverts to its original value, it does not appear in the diff at all. This efficient reporting minimizes data processing.

To facilitate access to this crucial information, EIP-7906 proposes three new Ethereum Virtual Machine (EVM) opcodes:

• TXTRACE: Enables the enumeration of all net state changes and emitted events.
• TXDIFF: Allows for the retrieval of specific starting and final values for designated addresses and storage slots.
• EVENTDATACOPY: Facilitates copying an event’s data into memory for detailed inspection.

Crucially, these opcodes are restricted to operate only within a POST_TX frame, which executes as a static call. This read-only nature prevents the assertion logic itself from inadvertently altering the blockchain state, maintaining its integrity as a purely verificational step. If any assertion rule within the POST_TX frame fails, the entire execution body of the transaction is reverted. However, the transaction still remains in the block with a "failed" status, and the gas payer is charged for the gas consumed up to the point of reversion. This mechanism is vital to prevent attackers from exploiting the system by submitting deliberately failing transactions to force builders to execute costly operations for free.

EIP-8141, which provides the foundational frame transaction type, is currently scheduled for inclusion in the upcoming Hegotà network upgrade, a major hard fork that will introduce several protocol changes to Ethereum. EIP-7906, while considered for inclusion, is not yet confirmed for this upgrade, indicating ongoing deliberation and refinement within the core development community.

The Crucial Requirement: Ensuring Assertion Adoption

A significant design consideration for EIP-7906 is that it does not inherently require transactions to include an assertion. This means that, by default, a transaction builder could omit an assertion, potentially bypassing the intended security benefits. Therefore, the widespread adoption and effectiveness of native transaction assertions hinge on proactive integration by ecosystem participants:

• Wallet Responsibility: For user-initiated transactions, wallets will play a pivotal role. They must be engineered to ensure that every frame transaction they construct includes the necessary assertions. These rules could be dynamically generated based on a simulation run by the wallet or derived from a user’s pre-defined, standing security policies applicable to all their transactions.
• Protocol Enforcement: For protocols seeking to enhance their security, protected functions within smart contracts would need to verify that incoming calls originate from a frame transaction containing the exact required assertion. Such protocols would need to explicitly reject ordinary transactions or frame transactions with missing or incorrect assertions. This presents a challenge for already deployed, immutable contracts, which cannot easily be upgraded to incorporate this new checking mechanism. New deployments or upgradeable proxies would be best positioned to leverage this feature.

Broader Implications and Future Use Cases

Beyond the immediate security benefits for individual users and protocols, native transaction assertions hold the potential to unlock a range of advanced use cases across the Ethereum ecosystem:

• Strengthened Delegation: When users delegate authority to an agent (e.g., a smart contract wallet or a third-party service) to act on their behalf, assertions can provide unprecedented control. While existing methods allow limiting which contracts an agent can interact with, how much it can spend, or the duration of its permissions, assertions can add granular rules for the outcome of each transaction. This means users can constrain not only what the agent may do but also what its actions must produce.
• Protocol-Defined Safety Checks: Protocols could define standardized, on-chain safety rules that every caller using a frame transaction must adhere to. This would create a uniform security baseline, reducing the risk of unexpected outcomes for all users interacting with the protocol.
• Enhanced Solver Execution: In complex transaction settlement flows, such as those involving decentralized exchanges with solver-based execution (like CoW Swap), assertions could empower the protocol to specify the required outcome (e.g., minimum received amount) while granting solvers the flexibility to choose the most optimal execution route. This guarantees user intent without overly constraining liquidity providers. It’s important to note this guarantee would apply within a single transaction on one network and not span multiple chains.
• Workflow Final State Verification: Assertions could be used to ensure that multi-step workflows reach their intended final state. For example, verifying that unused tokens are returned to the user, or that any temporary token approvals granted during a process are revoked post-completion. This adds a crucial layer of integrity to complex decentralized applications.

Ethereum’s Commitment to Trillion-Dollar Security

The Trillion Dollar Security initiative underscores the Ethereum Foundation’s deep commitment to enhancing user safety and system robustness as the network continues to scale and attract an ever-growing volume of economic activity. As Ethereum matures into a global settlement layer, the imperative to eliminate vulnerabilities related to transaction finality becomes paramount. Native transaction assertions, alongside Clear Signing and continuous research into blockchain security, represent a proactive and foundational effort to build a more secure and predictable environment for all participants. This strategic investment in core protocol security is crucial for fostering broader adoption and trust in decentralized technologies.

Community Engagement and Design Collaboration

The development of solutions for native transaction assertions remains an active area of research and design within the Ethereum Foundation. The initiative actively solicits feedback and collaboration from the wider Ethereum community, particularly from wallet developers and protocol teams who stand to benefit most directly from these advancements. Interested parties are encouraged to reach out to [email protected] to explore use cases, contribute to the research, and help shape the final design. Additionally, engagement in the EIP-7906 discussion thread on Ethereum Magicians (https://ethereum-magicians.org/t/eip-restricted-behavior-transaction-type/23130) is welcomed. Further information on risk controls and priority work can be found at trilliondollarsecurity.org. This collaborative approach is essential to ensure that the proposed solutions are robust, practical, and effectively address the diverse security needs of the rapidly evolving decentralized ecosystem.