ERC-8424 Draft Allows Forced Transfers on Encrypted Assets, Raises Security Concerns

A draft Ethereum standard called ERC-8424 has been published for review. This standard would allow issuers of tokenized real-world assets (RWAs) to force-transfer assets that still have encrypted amounts.

The pull request was made by Aryeh Greenberg, an OpenZeppelin developer who posts as arr00 in the ethereum/ERCs repository. ERC-8424 builds on top of the existing ERC-7984 standard for private tokens that store amounts as encrypted pointers.

The draft includes two public checks and three private functions to ensure the transfer process is secure. However, a reviewer has pointed out a potential vulnerability in the draft, which could allow anyone to look into someone else's account by calling the spendable-balance function without any restrictions.

A forum participant named zexoverz found this issue on the Ethereum Magicians thread and suggested that the same rule as OpenZeppelin's current ERC7984Freezable code should be applied to the spec. The draft is still under review and needs one more review from an Ethereum editor before it can be finalized.