Ethereal news #45
Binance had a $6.3B security incident, says it will cover losses, and about $3B has been frozen so far.
The Binance incident and the security boundary of EIP-7702
tayvano: the prior biggest hack was Bybit at about $1.5B; in the hours after this one, twice that amount was frozen, and more still was not
11:59.
Martin Köppelmann: seeing rumors blaming EIP-7702 for the Binance hack
05:04; from what he can see, 7702 was just used to perform the hack efficiently and was not the root cause.
Derek Chiang: quick notes on 7702
07:13; 7702 itself is not broken, and there is no need to panic if you use a wallet that supports it (MetaMask, Uniswap, Ambire and others).
New EIP: permanent EOA delegation opt-out
(nicolashw, EIP-8476 discussion thread, 23:35). An EOA installs a non-executable code marker through a previously invalid type-4 self-transaction with an empty authorization list, after which no authorization, including a clearing one, can replace it. The EVM treats the marker as empty code (`EXTCODESIZE` is 0), so the account remains an ordinary EOA to contracts. The motivation is that institutional wallets, exchange hot wallets and treasuries do not need delegated execution and their operational controls may assume it is unavailable; it does not protect against private key compromise.
EIP-8476 discussion thread
New EIP: permanent EOA delegation opt-out (nicolashw, EIP-8476 discussion thread, 23:35). An EOA installs a non-executable code marker through a previously invalid type-4 self-transaction with an empty authorization list, after which no authorization, including a clearing one, can replace it. The EVM treats the marker as empty code (`EXTCODESIZE` is 0), so the account remains an ordinary EOA to contracts. The motivation is that institutional wallets, exchange hot wallets and treasuries do not need delegated execution and their operational controls may assume it is unavailable; it does not protect against private key compromise.
New EIP: recent block bound delegation authorizations
(dangerousfood, EIP-8477). Unused 7702 authorizations currently have no protocol-enforced freshness bound and stay usable whenever the nonce matches. The proposal has each authorization sign an execution block number and header hash and apply only while that block is one of the inclusion block's preceding 256 ancestors; legacy unanchored authorizations are rejected after activation, and installed delegations are unaffected.
Frame transactions and account specs
EIP-8141: clarify EXTCODEHASH restrictions for precompiles
(yperbasis). Under EIP-1052, an empty precompile account returns 0 from `EXTCODEHASH`, and sending it 1 wei changes the result to `keccak256("")`, so one transfer can invalidate many pending frame transactions; the draft bans `EXTCODEHASH` of active precompiles during validation.
EIP-8288: reuse proofs before recursive aggregation
(Marchhill).
ethresear.ch: post-quantum signatureless authorization with recursive verification
14:13; an authority publishes a commitment to a reusable secret, and each action is authorized by a fresh proof of knowledge.
New ERC: ERC-20 delayed unlock
And ERC-20 outgoing window limits (shargon), with opt-in holder-controlled outgoing locks, block-based unlock delays and an independent guardian veto.
ERC-20 outgoing window limits
New ERC: ERC-20 delayed unlock and ERC-20 outgoing window limits (shargon), with opt-in holder-controlled outgoing locks, block-based unlock delays and an independent guardian veto.
Other updates
EIP-8148: specify contract input, log and eth_config key
Merged; store the sweep threshold in withdrawal credentials, merged.
store the sweep threshold in withdrawal credentials
EIP-8148: specify contract input, log and eth_config key, merged; store the sweep threshold in withdrawal credentials, merged.
EIP-8450: BLS-authorized key changes and more
Was merged, followed by addressing post-merge review.
addressing post-merge review
EIP-8450: BLS-authorized key changes and more was merged, followed by addressing post-merge review.
nero_eth: new client just dropped
01:54; binji: more teams building Ethereum clients is what makes this chain unique, 02:51.
binji: more teams building Ethereum clients is what makes this chain unique
Nero_eth: new client just dropped, 01:54; binji: more teams building Ethereum clients is what makes this chain unique, 02:51.
Aztec: Nyx receivers hand out a different Ethereum address each time, with no visible link to your private account
23:50, launching soon on Alpha V6.
StarkWare: the community voted 93% in favor of researching a fully post-quantum Starknet L1
16:17.
Magicians: ERC draft, independent simulation result for STVA
12:44.
Community
dankrad: time to be super careful online, people are getting hacked everywhere
21:16.
Martin Köppelmann: just like with shoplifting, users ultimately pay for every dollar lost in a hack
15:41.