Since the announcement of Dollars Billion Safety ProjectWe studied ecosystem to understand what improvements are the highest for each layer of the battery and the Ethereum community.
Now is the time to start the next phase of this initiative: to act on the highest priority problems we face.
For this first wave of actions, we will mainly focus on UX problems. Our research has shown that these are the most urgent problems faced by individual and institutional users of applications based on Ethereum and Ethereum.
During this first wave, we will launch a range of work targeting the crucial domains in UX security. The work we are starting out today is a combination of short -term short -term actions and long -term projects which, in our view, will continue for years. We intend to regularly launch new waves of projects, by attacking various priority security areas over time. While these projects are gaining momentum in the coming weeks and months, we will turn our attention to the next wave of priorities targeting other areas.
As always, we are impatient to support and collaborate with other people working to further improve Ethereum’s safety and make Ethereum safer for billions of users and billions of dollars in chain capital. Contact trilliondollarsecurity@ethereum.org.
1. Coordination of a “minimum safety standard” for Ethereum and proof Portfolio
The UX portfolio is where security starts for all Ethereum users. If users cannot safely manage the keys, sign transactions and interact with chain applications, they cannot use Ethereum safely.
We believe that the Ethereum ecosystem should develop and adopt a minimum safety standard for portfolios, which can serve as a trust and legitimate point of reference for which portfolios are safe for ordinary Ethereum users. We believe that this standard should require features such as:
- Transparent transactions
- Compromise -resistant interfaces
- Architecture to support confidentiality
- Portfolio behavior standards, for example, approval management, keys manipulation, front verification
- + More
We are inspired by the success of L2Beat in the education of users and the realization of the security and decentralization properties of the transparent L2s to the ecosystem.
We believe that a minimum safety standard for wallets could help tackle two different sides of this problem. Firstly, giving ordinary users a reliable guide to choose only the portfolios that meet this standard means that the greater share of Ethereum users will have access to the features they need to have a secure chain experience. To do this effectively, the standard must be a very high bar and it must be regularly increased as new security features are developed by the ecosystem or new threats. Second, the standard will encourage portfolio teams to prioritize important features to remain in conformity.
To help develop and promote such a standard, we are delighted to provide a to agree has Portfoliowho worked towards a similar vision. WalletBeat will be both a contributor to this community standard and an organization that can help do the hard work to measure portfolios in relation to the standard and make information easily accessible to users.
Stay listening for more information on work on this standard and how to contribute.
2. Unblocks of “technological tree” to resolve the blind signature
One of the most important problems with which UX security is confronted is the blind signature. Users should often sign transactions without the possibility of understanding what these transactions will do.
Thanks to discussions with ecosystem advisers and our commissioners, we have identified a few ways to unlock “technological tree structure” which will allow more portfolios to deploy features to solve this problem.
Unlock transaction decoding
One solution to the blind signature problem is that the portfolios decade the raw transaction data and translate it into a description readable by man from what the transaction will do. Instead of seeing a long code channel, a user can see information such as “transfer 1,000 ABC tokens to the recipient 0x123”.
A challenge for portfolio teams is that this type of functionality requires a full data signature data set, which requires access to the databases of verified contracts, many of which are closed and require costly licenses to use.
In recent years, the Check Alliance (Vera) has worked quietly to remedy it, and has today built a database of more than eight million contracts. Thanks to our research, it has become clear that many teams were not aware of the resources that Vera offers, and in the coming weeks and months, we will promote their work to guarantee that portfolio teams are aware of these open source resources and exploring other ways to maximize the impact of their work.
Second, we start certain R&D projects which, in our view, could unlock new methods of transparency transparency in wallets.
- Standards that encourage applications to add code to their contracts, allowing wallets to more easily interpret transactions.
- Revisiting the past proposals to solve this problem which was not priority by the ecosystem at the time, such as ERC 4430, EIP 7730, EIP 719, and explore how to continue the work of the Transactions group readable by man.
The portfolios can even go further and simulate the results of a transaction in an EVM environment against the current state of Ethereum. This simulation would then send a message like “this X will send you 1 eTh from X to Y and receive 1 NFT from the Y collection” “
If the portfolios could reliably classify the level of confidence in the contracts with which users interact, this would go even more to solving this problem.
Some portfolios offer these features today, but we want to facilitate more portfolios and that all the transaction simulation features are reliable and of high quality.
We have also started several R&D projects to explore if improvements in protocol on things such as opt-in transaction claims and additional safety features would further increase user safety.
3. facing developers to avoid deploying vulnerable code more easily
Having an open source of intelligent contract vulnerability database, which can be used as a reference by IDE and other developer tools, is something that could help reduce compromise contracts. These tools could scan predefined contracts against the open source database before deploying onchain code, allowing developers to more easily detect vulnerabilities in their application before deploying it.
Although it is not strictly a UX project, we believe that it is a high lever effect company where the EF is in a unique position to help coordinate a widely used database, and we invite anyone who wishes to help, such as audit competition platforms, listeners, white or other hats, to help contribute their results.
Once we have in place an open -scale open source database, the next step is to plead for tool developers in order to create features that take advantage of it.
This is what the ecosystem can help:
Ultra simple non -technical wallet
A very common feedback element during our investigation phase was that existing portfolios target the technological crowd. There seems to be a high demand for portfolios for non -technical users from around the world who provide features that practically ensure a secure environment by building childcare rails that always allow users to have chain experience. Respondents in the survey mentioned things such as easy transactions for friends and businesses (without having to type a public key), easy payments for goods and services, the integrated basic exchange and the possibility of restoring your wallet. If you have any ideas on how to solve these problems, please contact.
Company -focused portfolios
Companies have mentioned the importance of privacy, resistance to censorship (including external services used by the portfolio to interact with the network) and compliance requirements for key management. If you have ideas on how to solve this problem, please contact.
