以太坊的 Pectra 升级：使用 EIP-3074 增强用户体验，但存在安全问题

以太坊的 Pectra 升级正在考虑 EIP-3074，这是一项旨在通过启用帐户抽象来增强用户体验的附加功能。然而，人们对潜在的安全风险提出了担忧，包括由于调用程序错误或复杂的网络钓鱼攻击而导致资产损失的可能性。虽然 EIP-3074 支持者认为它可以简化现有钱包的账户抽象，但怀疑者认为它可能会阻碍向 ERC-4337 等更全面的账户抽象解决方案的过渡。

Ethereum's Upcoming Pectra Upgrade: Enhancing User Experience with EIP-3074, But at What Cost?

以太坊即将推出的 Pectra 升级：通过 EIP-3074 增强用户体验，但代价是什么？

Ethereum developers are diligently working on the next major upgrade to the Ethereum network, dubbed Pectra, which is expected to bring a suite of enhancements aimed at improving the overall user experience. Among the proposed changes, EIP-3074 has garnered significant attention for its potential to revolutionize how users interact with their Ethereum wallets. However, while EIP-3074 holds the promise of significant benefits, experts have raised concerns about its potential security implications.

以太坊开发人员正在努力进行以太坊网络的下一次重大升级，称为 Pectra，预计将带来一系列旨在改善整体用户体验的增强功能。在提议的更改中，EIP-3074 因其具有彻底改变用户与以太坊钱包交互方式的潜力而受到广泛关注。然而，尽管 EIP-3074 有望带来重大好处，但专家们对其潜在的安全影响表示担忧。

EIP-3074: Bringing Account Abstraction to Regular Wallets

EIP-3074：将帐户抽象引入常规钱包

EIP-3074 proposes to introduce account abstraction to standard Ethereum wallets, a feature currently available only through smart contract wallets. Account abstraction involves separating the Ethereum address, which serves as the public identifier on the blockchain, from the private key, which grants access to the funds associated with that address. This separation enhances security by eliminating the risk of losing funds due to compromised private keys.

EIP-3074 提议将帐户抽象引入标准以太坊钱包，该功能目前仅通过智能合约钱包提供。账户抽象涉及将以太坊地址（充当区块链上的公共标识符）与私钥分离，私钥授予与该地址关联的资金的访问权限。这种分离消除了因私钥泄露而导致资金损失的风险，从而增强了安全性。

Benefits of EIP-3074

EIP-3074 的优点

EIP-3074 promises several key advantages for Ethereum wallet users:

EIP-3074 为以太坊钱包用户带来了几个关键优势：

• Improved transaction efficiency: Users can batch multiple transactions into a single operation, reducing gas fees and transaction confirmation times.
• Increased flexibility: Wallets can delegate control to smart contracts, known as invokers, allowing for features like sponsored transactions and social recovery in case of lost private keys.
• Enhanced user experience: Signing a single transaction can initiate a complex process involving multiple transactions, such as DEX swaps or asset transfers.

Security Concerns over EIP-3074

提高交易效率：用户可以将多个交易批量处理为一次操作，从而减少汽油费和交易确认时间。提高灵活性：钱包可以将控制权委托给智能合约（称为调用者），从而允许赞助交易和丢失时社交恢复等功能私钥。增强的用户体验：签署单个交易可以启动涉及多个交易的复杂流程，例如 DEX 互换或资产转移。EIP-3074 的安全问题

Despite its potential benefits, EIP-3074 has raised concerns among security experts. The primary worry is that it introduces new attack vectors that could result in the loss of funds. Here are the main security risks associated with EIP-3074:

尽管 EIP-3074 具有潜在的好处，但它还是引起了安全专家的担忧。主要的担忧是它引入了新的攻击向量，可能导致资金损失。以下是与 EIP-3074 相关的主要安全风险：

• Invoker bugs: Malicious invokers could exploit vulnerabilities to drain users' funds or execute unauthorized transactions.
• Phishing attacks: Sophisticated phishing scams could trick users into signing transactions that cede control of their accounts to attackers.

EIP-3074 versus ERC-4337: Different Approaches to Account Abstraction

调用程序错误：恶意调用程序可能会利用漏洞来耗尽用户的资金或执行未经授权的交易。网络钓鱼攻击：复杂的网络钓鱼诈骗可能会诱骗用户签署交易，从而将其帐户的控制权交给攻击者。EIP-3074 与 ERC-4337：不同的方法账户抽象

While EIP-3074 and ERC-4337 share the goal of enhancing wallet security and usability, they differ in their implementation. ERC-4337 advocates for replacing standard wallets with smart contract wallets, while EIP-3074 modifies the Ethereum Virtual Machine (EVM) to allow regular wallets to delegate control to invokers.

虽然 EIP-3074 和 ERC-4337 的共同目标都是增强钱包安全性和可用性，但它们的实现方式有所不同。 ERC-4337主张用智能合约钱包取代标准钱包，而EIP-3074修改了以太坊虚拟机（EVM）以允许常规钱包将控制权委托给调用者。

Proponents of ERC-4337 argue that it offers a more comprehensive account abstraction solution with greater user control and security. They believe it is the ultimate path to a more user-friendly and secure Ethereum ecosystem. However, concerns exist that the coexistence of two different wallet implementations could lead to interoperability issues in the future.

ERC-4337 的支持者认为，它提供了更全面的账户抽象解决方案，具有更强的用户控制力和安全性。他们相信这是通往更加用户友好和安全的以太坊生态系统的最终途径。然而，人们担心两种不同钱包实现的共存可能会导致未来的互操作性问题。

Experts' Views on EIP-3074

专家对EIP-3074的看法

DefiLlama founder 0xngmi has voiced concerns that EIP-3074 could result in devastating losses for users: "Now it'll be possible to fully drain an address (all tokens, all NFTs, all Defi positions...) with only one bad signature." Ethereum researcher and co-author of EIP-3074, Angsar Dietrichs, acknowledges the potential security risks but believes EIP-3074 is a necessary step towards account abstraction, which he views as an inevitable transition.

DefiLlama 创始人 0xngmi 表达了对 EIP-3074 可能给用户造成毁灭性损失的担忧：“现在只需一个错误签名就可以完全耗尽一个地址（所有代币、所有 NFT、所有 Defi 头寸……）。 ”以太坊研究员兼 EIP-3074 的合著者 Angsar Dietrichs 承认存在潜在的安全风险，但认为 EIP-3074 是迈向帐户抽象的必要步骤，他认为这是不可避免的过渡。

Uniswap Founder's Perspective

Uniswap 创始人的观点

Hayden Adams, founder of Uniswap, suggests that improvements to DApp user experience could mitigate some of the security concerns surrounding EIP-3074. He believes that better onboarding processes and educational resources can help users understand the potential risks and take appropriate precautions.

Uniswap 创始人 Hayden Adams 表示，改进 DApp 用户体验可以缓解围绕 EIP-3074 的一些安全问题。他认为，更好的入职流程和教育资源可以帮助用户了解潜在风险并采取适当的预防措施。

Conclusion

结论

The Ethereum Pectra upgrade is expected to bring significant enhancements to the Ethereum network, including EIP-3074, which promises to revolutionize the user experience of Ethereum wallets. However, it is crucial to carefully consider the potential security implications associated with EIP-3074 and explore alternative solutions, such as ERC-4337, which may offer a more robust and secure approach to account abstraction. As the Ethereum ecosystem evolves, ongoing discussions and careful consideration will be necessary to ensure that user-friendly features do not compromise the security of the network and its users' assets.

以太坊 Pectra 升级预计将为以太坊网络带来重大增强，其中包括 EIP-3074，它有望彻底改变以太坊钱包的用户体验。然而，仔细考虑与 EIP-3074 相关的潜在安全隐患并探索替代解决方案（例如 ERC-4337）至关重要，它可能提供更强大、更安全的帐户抽象方法。随着以太坊生态系统的发展，需要持续的讨论和仔细的考虑，以确保用户友好的功能不会损害网络及其用户资产的安全。