以太坊的 Pectra 升級：使用 EIP-3074 增強使用者體驗，但有安全問題

以太坊的 Pectra 升級正在考慮 EIP-3074，這是一項旨在透過啟用帳戶抽象化來增強使用者體驗的附加功能。然而，人們對潛在的安全風險提出了擔憂，包括由於呼叫程式錯誤或複雜的網路釣魚攻擊而導致資產損失的可能性。雖然 EIP-3074 支持者認為它可以簡化現有錢包的帳戶抽象，但懷疑者認為它可能會阻礙向 ERC-4337 等更全面的帳戶抽象解決方案的過渡。

Ethereum's Upcoming Pectra Upgrade: Enhancing User Experience with EIP-3074, But at What Cost?

以太坊即將推出的 Pectra 升級：透過 EIP-3074 增強用戶體驗，但代價是什麼？

Ethereum developers are diligently working on the next major upgrade to the Ethereum network, dubbed Pectra, which is expected to bring a suite of enhancements aimed at improving the overall user experience. Among the proposed changes, EIP-3074 has garnered significant attention for its potential to revolutionize how users interact with their Ethereum wallets. However, while EIP-3074 holds the promise of significant benefits, experts have raised concerns about its potential security implications.

以太坊開發人員正在努力進行以太坊網路的下一次重大升級，稱為 Pectra，預計將帶來一系列旨在改善整體用戶體驗的增強功能。在提議的更改中，EIP-3074 因其具有徹底改變用戶與以太坊錢包互動方式的潛力而受到廣泛關注。然而，儘管 EIP-3074 預計將帶來重大好處，但專家們對其潛在的安全影響表示擔憂。

EIP-3074: Bringing Account Abstraction to Regular Wallets

EIP-3074：將帳戶抽象化引入常規錢包

EIP-3074 proposes to introduce account abstraction to standard Ethereum wallets, a feature currently available only through smart contract wallets. Account abstraction involves separating the Ethereum address, which serves as the public identifier on the blockchain, from the private key, which grants access to the funds associated with that address. This separation enhances security by eliminating the risk of losing funds due to compromised private keys.

EIP-3074 提議將帳戶抽象化引入標準以太坊錢包，該功能目前僅透過智慧合約錢包提供。帳戶抽象化涉及將以太坊地址（充當區塊鏈上的公共識別碼）與私鑰分離，私鑰授予與該地址關聯的資金的存取權。這種分離消除了因私鑰外洩而導致資金損失的風險，從而增強了安全性。

Benefits of EIP-3074

EIP-3074 的優點

EIP-3074 promises several key advantages for Ethereum wallet users:

EIP-3074 為以太坊錢包用戶帶來了幾個關鍵優勢：

• Improved transaction efficiency: Users can batch multiple transactions into a single operation, reducing gas fees and transaction confirmation times.
• Increased flexibility: Wallets can delegate control to smart contracts, known as invokers, allowing for features like sponsored transactions and social recovery in case of lost private keys.
• Enhanced user experience: Signing a single transaction can initiate a complex process involving multiple transactions, such as DEX swaps or asset transfers.

Security Concerns over EIP-3074

提高交易效率：使用者可以將多個交易批量處理為一次操作，從而減少汽油費和交易確認時間。遺失時社交復原等功能私鑰。

Despite its potential benefits, EIP-3074 has raised concerns among security experts. The primary worry is that it introduces new attack vectors that could result in the loss of funds. Here are the main security risks associated with EIP-3074:

儘管 EIP-3074 具有潛在的好處，但它還是引起了安全專家的擔憂。主要的擔憂是它引入了新的攻擊向量，可能導致資金損失。以下是與 EIP-3074 相關的主要安全風險：

• Invoker bugs: Malicious invokers could exploit vulnerabilities to drain users' funds or execute unauthorized transactions.
• Phishing attacks: Sophisticated phishing scams could trick users into signing transactions that cede control of their accounts to attackers.

EIP-3074 versus ERC-4337: Different Approaches to Account Abstraction

呼叫程式錯誤：惡意呼叫程式可能會利用漏洞來耗盡用戶的資金或執行未經授權的交易。攻擊者。EIP-3074 與ERC-4337：不同的方法帳戶抽象

While EIP-3074 and ERC-4337 share the goal of enhancing wallet security and usability, they differ in their implementation. ERC-4337 advocates for replacing standard wallets with smart contract wallets, while EIP-3074 modifies the Ethereum Virtual Machine (EVM) to allow regular wallets to delegate control to invokers.

雖然 EIP-3074 和 ERC-4337 的共同目標都是增強錢包安全性和可用性，但它們的實現方式有所不同。 ERC-4337主張以智慧合約錢包取代標準​​錢包，而EIP-3074修改了以太坊虛擬機器（EVM）以允許常規錢包將控制權委託給呼叫者。

Proponents of ERC-4337 argue that it offers a more comprehensive account abstraction solution with greater user control and security. They believe it is the ultimate path to a more user-friendly and secure Ethereum ecosystem. However, concerns exist that the coexistence of two different wallet implementations could lead to interoperability issues in the future.

ERC-4337 的支持者認為，它提供了更全面的帳戶抽象解決方案，具有更強的使用者控制力和安全性。他們相信這是通往更用戶友好和安全的以太坊生態系統的最終途徑。然而，人們擔心兩種不同錢包實現的共存可能會導致未來的互通性問題。

Experts' Views on EIP-3074

專家對EIP-3074的看法

DefiLlama founder 0xngmi has voiced concerns that EIP-3074 could result in devastating losses for users: "Now it'll be possible to fully drain an address (all tokens, all NFTs, all Defi positions...) with only one bad signature." Ethereum researcher and co-author of EIP-3074, Angsar Dietrichs, acknowledges the potential security risks but believes EIP-3074 is a necessary step towards account abstraction, which he views as an inevitable transition.

DefiLlama 創始人 0xngmi 表達了對 EIP-3074 可能給用戶造成毀滅性損失的擔憂：“現在只需一個錯誤簽名就可以完全耗盡一個地址（所有代幣、所有 NFT、所有 Defi 頭寸……）。 ”以太坊研究員兼 EIP-3074 的合著者 Angsar Dietrichs 承認存在潛在的安全風險，但認為 EIP-3074 是邁向帳戶抽象的必要步驟，他認為這是不可避免的過渡。

Uniswap Founder's Perspective

Uniswap 創辦人的觀點

Hayden Adams, founder of Uniswap, suggests that improvements to DApp user experience could mitigate some of the security concerns surrounding EIP-3074. He believes that better onboarding processes and educational resources can help users understand the potential risks and take appropriate precautions.

Uniswap 創辦人 Hayden Adams 表示，改進 DApp 使用者體驗可以緩解圍繞 EIP-3074 的一些安全問題。他認為，更好的入職流程和教育資源可以幫助使用者了解潛在風險並採取適當的預防措施。

Conclusion

結論

The Ethereum Pectra upgrade is expected to bring significant enhancements to the Ethereum network, including EIP-3074, which promises to revolutionize the user experience of Ethereum wallets. However, it is crucial to carefully consider the potential security implications associated with EIP-3074 and explore alternative solutions, such as ERC-4337, which may offer a more robust and secure approach to account abstraction. As the Ethereum ecosystem evolves, ongoing discussions and careful consideration will be necessary to ensure that user-friendly features do not compromise the security of the network and its users' assets.

以太坊 Pectra 升級預計將為以太坊網路帶來重大增強，其中包括 EIP-3074，它有望徹底改變以太坊錢包的用戶體驗。然而，仔細考慮與 EIP-3074 相關的潛在安全隱患並探索替代解決方案（例如 ERC-4337）至關重要，它可能提供更強大、更安全的帳戶抽象方法。隨著以太坊生態系統的發展，需要持續的討論和仔細的考慮，以確保用戶友好的功能不會損害網路及其用戶資產的安全。