Ethereum Foundation Proposes Native Transaction Assertions to Enhance Security

The Ethereum Foundation's Trillion Dollar Security initiative is tackling blind signing and transaction uncertainty as key user experience risks. The project is exploring native transaction assertions as a way to enforce a transaction’s final outcome, complementing existing solutions like Clear Signing. These assertions aim to address cases where a valid signature doesn’t guarantee the desired transaction result, protecting users from unintended outcomes.

Two main scenarios highlight the problem. First, intent mismatches occur when users approve something different from what they believed they were signing, as seen in the Bybit incident and the BadgerDAO attack. Second, outcome mismatches happen when users approve a request but the execution still produces an unwanted result, like in the Aave and CoW collateral swap, where a user lost significant value due to thin liquidity and a high price impact.

Current defenses, such as Clear Signing and simulation, have limitations. Clear Signing explains the action requested by the calldata but relies on accurate decoding and user recognition of discrepancies. Simulation predicts transaction effects but can't account for changes between simulation and execution. Contract checks and wallet guards also have constraints, as they can't inspect the full set of net state changes.

Native transaction assertions would allow onchain code to inspect the full set of net state changes after a transaction runs. An assertion uses read-only logic to compare starting and final values against a rule, reverting the transaction if the rule fails. The rule can cover balances, storage, code, deployed contracts, and emitted events, ensuring outcomes align with user intent or standing policies.

EIP-7906 proposes a solution with frame transactions, adding a read-only POST_TX frame to check the transaction’s outcome. This approach exposes state changes and events, with new opcodes like TXTRACE, TXDIFF, and EVENTDATACOPY providing access to this information. While EIP-8141 is scheduled for the Hegotá upgrade, EIP-7906 is still under consideration.