🎉 Hey Gate Square friends! Non-stop perks and endless excitement—our hottest posting reward events are ongoing now! The more you post, the more you win. Don’t miss your exclusive goodies! 🚀
🆘 #Gate 2025 Semi-Year Community Gala# | Square Content Creator TOP 10
Only 1 day left! Your favorite creator is one vote away from TOP 10. Interact on Square to earn Votes—boost them and enter the prize draw. Prizes: iPhone 16 Pro Max, Golden Bull sculpture, Futures Vouchers!
Details 👉 https://www.gate.com/activities/community-vote
1️⃣ #Show My Alpha Points# | Share your Alpha points & gains
Post your
Investors lost 1 million USD in just 1 click on a fake Uniswap.
A phishing attack caused a cryptocurrency investor to lose nearly 1 million USD after inadvertently signing a series of malicious transactions disguised as swaps on Uniswap, according to a report by blockchain security firm Scam Sniffer.
On August 22, Yu Xiang – the founder of SlowMist – stated that the incident involves 5 types of tokens that were stolen through transactions exploiting Ethereum's new EIP-7702 mechanism.
He explained: "From the perspective of the attacked user, the process occurs as follows: they open a phishing website, a wallet signing dialog appears, they click confirm, and with just that one action, all valuable assets in the wallet disappear immediately."
EIP-7702 and new risks
EIP-7702 was introduced in the Pectra upgrade to enhance the Ethereum user experience. This feature allows wallets to function as a temporary smart contract, enabling multiple transactions to be executed simultaneously, allowing for gas fee sponsorship or setting spending limits in just one step.
In principle, this power of attorney can be revoked and only applies within a specific network. However, in practice, attackers have found ways to exploit this mechanism.
Security Community Alert
Market maker Wintermute warns that the deployment of this standard is being widely exploited. An analysis from June by the company showed that over 90% of EIP-7702 authorizations are related to malicious contracts. Many contracts are just simple copy-paste code, automatically scanning and withdrawing assets from vulnerable wallets.
Scam Sniffer and Yu Xiang recommend that users exercise caution before signing requests from wallets. Preventive measures include: carefully checking the domain name, not confirming hastily, and refusing ambiguous signatures or those with excessively broad scopes.
Some warning signs include: requests for unlimited spending permissions, upgrading contracts according to EIP-7702, or simulating transactions that do not meet expectations.
Thach Sanh