- Buy Crypto
- Markets
Futures- Spot
- Copy Trade
- Earn
- More
Careful when signing messages in Ethereum Pectra
By: protos|2025/05/08 03:00:04
0
Share
The Ethereum blockchain forked today for its Pectra code change and introduced a suite of new features, upgrades, and vulnerabilities.However, within an hour of the changeover, concerned users were warning about a new threat vector: message signing.“Be careful what you sign... It is enough to drain all tokens,” posted one user to Telegram. Another Ethereum user echoed the warning, saying, “You only have to sign a message to get completely drained!”Many other warnings flagged similar risks.Ethereum’s Pectra upgrade included Ethereum Improvement Proposal (EIP) 3074, which has introduced new AUTH and AUTHCALL Ethereum operation codes. These opcodes allow the holder of an Ethereum private key to delegate authorization to a smart contract.Developers called it an important step in achieving account abstraction. However, critics say it has introduced new phishing attacks that allow theft of all assets in a user’s wallet once they delegate control of their keys.pectra pros:>approve spend then swap is deadpectra cons:>signing messages just got a whole lot spicier— sloth (@0xSloth) May 7, 2025Signing Ethereum messages just got a whole lot spicier.Careful signing Ethereum transactions and messagesEIP-3074’s co-authors tried to calm fears with a post published on Binance claiming to be “unaware” of any wallet that allowed signing of improperly prefixed messages without a user warning.Transactions use the prefix 0x04, and the authors of the EIP hope that all major Ethereum wallets will flag 0x04 messages with prominent warnings to inform the user about their expansive power to authorize multiple withdrawals, including possible theft. “The caller field in the EIP-3074 signature is very important,” they wrote solemnly. “A bad caller could steal your funds.”Why ether underperformed bitcoin in 2024Read more: Seneca Protocol hack highlights dangers of Ethereum’s token approval mechanismToday’s Pectra fork also added EIP-7702, raising the stakes even higher. With the power of EIP-7702, a single malicious signature can temporarily delegate someone’s entire account to a third-party smart contract.If that contract is malicious, it could potentially drain all assets (ETH, tokens, NFTs) in one go. As opposed to pre-Pectra Ethereum transactions, the possible attack surface for victims is broader with EIP-7702 because externally owned accounts (EOAs) are now exposed to third-party temporary smart contract vulnerabilities.This temporary delegation of executable code was not a concern before Pectra.Although warnings are proliferating across social media, there are no reports yet of a successful theft of funds using the new Pectra-enabled attack vector.Most wallet providers like MetaMask were prepared for Pectra and added prominent warnings for EIP-3074 message signings.Got a tip? Send us an email securely via Protos Leaks. For more informed news, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.The post Careful when signing messages in Ethereum Pectra appeared first on Protos.
You may also like
Ten Thousand Words Interpretation of STRC: Strategy for Making Money to Buy Coins New Magic
The real momentum of the BTC rebound - for every 1 dollar of STRC issued, there corresponds 3 dollars of BTC buying.
What competitive advantages are still defensible in the AI era?
Based on the signals received, determine the direction, and act immediately
For Whom the Bell Tolls, For Whom the Lobster Feeds? A Dark Forest Survival Guide for the 2026 Agent Player
If an AI has read Machiavelli and is much smarter than us, they would be very good at manipulating us — and you wouldn't even realize what's happening.
Circle CEO's Latest Interview: Stablecoins Are Not Cryptocurrency
The true meaning of a stablecoin is to turn the US dollar into an internet-native currency and eventually create an internet financial platform
Deconstructing the Public Chain Pharos Capital Game: Is a $950 million valuation supported by assets like photovoltaics just a shell transaction under layers of betting?
When a physical industry company injects physical assets into a Layer 1 project, it can easily create a valuation of 950 million dollars by calculating several times the value of the physical assets. Is this kind of capital game too outrageous? Does the crypto market really need such RWAs?
a16z: AI is making everyone 10x more productive, but the true winner has yet to emerge
Institutional AI and Retail AI "Better Integration" is an Inevitable Trend.
Why did the star Web3 project Across Protocol choose to abandon DAO?
The proposal for Across to privatize itself is a rare move, but it comes at a time when the industry is beginning to recognize that DAOs are a difficult organizational structure to operate.
In fact, ETH scaling is a major benefit for L2
ETH has finally admitted defeat—its Rollup-centric roadmap is unworkable, while the monolithic scaling solutions adopted by blockchains like Solana have proven to be correct.
Memories: 10 Key Contributions of the TON Core Team That Few People Knew in the Early Days
Every line of code, every tool we build, every sleepless night spent maintaining the network—these efforts have laid the foundation for TON's development today.
2025 South Korea CEX Listing Post-Mortem: Investing in New Coins = 70% Loss?
The 2025 South Korean exchange's new token listing performance is structurally similar to Binance's, with no significant differences.
BIP-360 Analysis: Bitcoin's First Step Towards Quantum Immunity, But Why Only the "First Step"?
This article explains how BIP-360 reshapes Bitcoin's quantum defense strategy, analyzes its enhancements, and discusses why it has not yet achieved full post-quantum security.
50 million USDT exchanged for 35,000 USD AAVE: How did the disaster happen? Who should we blame?
Due to a fatal flaw in the transaction path, a $50 million DeFi operation was executed with almost zero protection, resulting in nearly the entire amount of funds evaporating in a tiny liquidity pool.
The Cryptographic Past of the Middle East
Reality is often more exciting than fiction.
Resolving the Intergenerational Prisoner's Dilemma: The Inevitable Path of Nomadic Capital Bitcoin
When the baby boomer generation collectively sells off, who will become the "greater fool" in the next round of asset crashes?
Who Will Control AI? Why Decentralized AI May Be the Only Alternative to Government and Big Tech
AI has become critical infrastructure, and governments and corporations are competing to control it. Centralized development and regulation are entrenching existing power structures. The Web3 community is building a decentralized alternative — distributed compute, token incentives, and community governance — before that window closes.
Vitalik wrote a proposal teaching you how to secretly use AI large models
Vitalik believes that in the AI era, users should not have to give up their identity to use an AI tool.
On the eve of the explosion of on-chain options
Options are becoming a new anchor in the cryptocurrency market.
WEEX AI Hackathon: How Did This AI Trading Winner Succeed?
A self-taught AI trading enthusiast achieved top-10 results at the WEEX AI Hackathon. Learn about the mindset, AI tools, and lessons behind this impressive performance.
Ten Thousand Words Interpretation of STRC: Strategy for Making Money to Buy Coins New Magic
The real momentum of the BTC rebound - for every 1 dollar of STRC issued, there corresponds 3 dollars of BTC buying.
What competitive advantages are still defensible in the AI era?
Based on the signals received, determine the direction, and act immediately
For Whom the Bell Tolls, For Whom the Lobster Feeds? A Dark Forest Survival Guide for the 2026 Agent Player
If an AI has read Machiavelli and is much smarter than us, they would be very good at manipulating us — and you wouldn't even realize what's happening.
Circle CEO's Latest Interview: Stablecoins Are Not Cryptocurrency
The true meaning of a stablecoin is to turn the US dollar into an internet-native currency and eventually create an internet financial platform
Deconstructing the Public Chain Pharos Capital Game: Is a $950 million valuation supported by assets like photovoltaics just a shell transaction under layers of betting?
When a physical industry company injects physical assets into a Layer 1 project, it can easily create a valuation of 950 million dollars by calculating several times the value of the physical assets. Is this kind of capital game too outrageous? Does the crypto market really need such RWAs?
a16z: AI is making everyone 10x more productive, but the true winner has yet to emerge
Institutional AI and Retail AI "Better Integration" is an Inevitable Trend.
App