Ethereum Pectra

Wintermute warns that EIP-7702 is subject to malicious abuse, and users may be affected by automated attacks

ChainCatcher news, according to TheBlock, Wintermute recently issued a warning that the Ethereum Pectra upgrade may expose users to automated attacks. The EIP-7702 feature (account abstraction improvement) in the Ethereum Pectra upgrade is being maliciously exploited, with over 80% of authorizations being used for automated attacks. Blockchain security company Scam Sniffer recently monitored a user who lost nearly $150,000 due to a phishing attack, where the attacker deployed a copy-paste contract named "CrimeEnjoyor" that can automatically drain wallets with leaked private keys. EIP-7702, proposed by Ethereum founder Vitalik Buterin, aims to enhance user experience by temporarily granting wallets smart contract functionality, including batch processing multiple transactions, sponsoring gas fees, using biometric/social verification, and setting single transaction limits.According to Wintermute's Dune dashboard, the vast majority of EIP-7702 authorizations flow to malicious contracts with similar functions. Security expert Taylor Monahan pointed out that EIP-7702 makes draining addresses "cheaper and easier." Wintermute commented, "It's both absurd and cruel that the same copied bytecode occupies most of the EIP-7702 authorizations."BlockBeats previously reported that SlowMist founder Yu Xian stated that the biggest users of the new Ethereum mechanism EIP-7702 are theft gangs (rather than phishing organizations). EIP-7702 allows for the automatic transfer of funds from wallets with leaked private keys or mnemonic phrases through authorizations, with over 97% of EIP-7702 delegations pointing to theft contracts.

Slow Fog: All parties need to pay attention to the new risks brought by the new features after the Ethereum Pectra upgrade

ChainCatcher news, security company Slow Mist stated on platform X that the Ethereum Pectra upgrade (EIP-7702) is now live------this is a significant leap, but the new features also bring new risks. Here are some points that users, wallet providers, developers, and exchanges should pay attention to:For users: Private key protection should always be a top priority; be aware that the same contract address on different chains may not always have the same contract code; understand the details of the delegation target before proceeding with operations.For wallet providers: Check if the delegation chain matches the current network; remind users of the risks associated with delegation signatures that have a chainID of 0, as these signatures may be replayed on different chains; display the target contract when users sign the delegation to reduce the risk of phishing attacks.For developers: Ensure permission checks are performed during wallet initialization (e.g., verify the signature address through Ecrecover); follow the namespace formula proposed in ERC-7201 to mitigate storage conflicts; do not assume Tx.Origin is always an externally owned account (EOA), using Msg.Sender == Tx.Origin as a defense against reentrancy attacks will no longer be effective; ensure that the target contract of user delegation implements the necessary callback functions to ensure compatibility with mainstream tokens.For centralized exchanges (CEXs): Conduct tracking checks on deposits to reduce the risk of false deposits from smart contracts.

QCP Capital: The options market is positioning for the Ethereum Pectra upgrade, while factors such as the weakness of altcoins may suppress upward momentum

ChainCatcher news, QCP Capital's latest analysis points out that the term structure of the options market has shown a significant distortion around the March expiration date, particularly in Ethereum options. This may reflect the market's positioning for the Ethereum Pectra upgrade, which is currently in the testing phase and expected to go live in early April.Looking back at past upgrades, the September 2022 merge upgrade followed the typical "buy the rumor, sell the news" pattern—ETH fell back after rising over 100% from the June low post-upgrade. In contrast, the Shanghai upgrade in April 2023, which enabled staking withdrawals, faced pessimism due to market concerns about oversupply. However, once the market realized that the selling pressure did not materialize as expected, ETH rose by 30% in the following months.As expectations for the upgrade heat up, traders may be positioning for another volatility event, with options volatility skewed towards call options after March 28—this could lay the groundwork for the next thematic play in the crypto market following the Trump tariff turmoil.One dampening factor is the general weakness in the altcoin market—LIBRA's collapse, SOL and ETH retreating to pre-election levels, and Bitcoin's market cap share nearing historical highs. Beyond market catalysts, altcoins may need to achieve substantial progress in real-world applications and network development to sustain a recovery, rather than relying solely on speculative capital flows.

Report: Ethereum Pectra Upgrade May Bring Multiple Risks

ChainCatcher news, according to Cointelegraph, as Ethereum is set to undergo the Pectra upgrade in early 2025, Liquid Collective and Obol have released a latest research report revealing several risks associated with this upgrade. The report emphasizes the importance of client, operator, and cloud diversity, while also expressing concerns about the limited adoption of Distributed Validator Technology (DVT). Matt Leisinger, Chief Product Officer of Alluvial, stated that addressing the risks associated with Ethereum staking and protocol-level penalties has become a pressing priority.The report specifically points out that potential bugs in mainstream clients could trigger severe slashing penalties and network instability. In terms of staking, operator diversity is crucial for maintaining network health and preventing single points of failure. Leisinger emphasized that stakers and service providers must rigorously assess relevance, diversity, and risk mitigation measures to address potential risks. Additionally, the report discusses the issue of cloud diversity, calling for widely distributed validators and cloud providers to enhance system resilience. DVT technology is seen as an important means to reduce associated risks and enhance validator resilience. For long-term resilience and institutional adoption, staking configurations should prioritize the diversity of node operators and validators.
ChainCatcher Building the Web3 world with innovators