Trust Wallet discloses high security alert DoS attack disclosure in conjunction with the Ethereum Foundation

Trust Wallet has disclosed that its security research arm, Trust Security, identified a high‑severity denial‑of‑service (DoS) attack vector in Ethereum’s ERC‑4337 account abstraction infrastructure and reported it through the Ethereum Foundation’s bug bounty program, leading to a coordinated public disclosure and fix. According to the Ethereum Foundation’s disclosure and coverage from independent crypto media, the vulnerability allowed an attacker to deliberately force certain ERC‑4337 account‑abstraction transactions to revert while still consuming gas, creating a censorship and griefing vector rather than a direct theft-of-funds exploit. The issue was handled under the Ethereum Foundation’s standard public disclosure process, which aims to publish details within about 90 days after a bug report once fixes are available. The Foundation awarded $50,000, its then‑maximum “high‑severity” bounty for this class of bug, to Trust Security for the find, and additional bounties were paid by DeFi projects relying on ERC‑4337. Developers addressed the problem by updating relevant contracts and tooling so that certain functions could no longer be called from vulnerable account‑abstraction paths, and projects using ERC‑4337 were urged to upgrade promptly. While real‑world impact was limited at the time due to relatively low usage of the specific vulnerable transaction type, ERC‑4337 activity was already accounting for a notable share of Ethereum transactions, so resolving the issue early was significant for preserving reliability and user experience as account abstraction scales. This disclosure sits within the Ethereum Foundation’s broader emphasis on “Trillion Dollar Security” and expanding bug‑bounty incentives to harden the protocol as it supports larger value and more complex use cases. For Trust Wallet and its user base, the episode underscores the wallet’s role not only as an application but also as a security contributor to core Ethereum infrastructure, complementing its own public education on DoS and DDoS-style attacks in blockchain environments.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Trust Wallet Browser Extension v2.68 Incident: An Update to Our ... (trustwallet.com)
• Ethereum Foundation launches 'One Trillion Dollar Security ... (cryptopolitan.com)
• Ethereum Foundation awards $50,000 to researchers who identified ... (dlnews.com)
• ethereum/public-disclosures - GitHub (github.com)
• DDoS attacks in blockchain networks, explained - Trust Wallet (trustwallet.com)

Explore the topic

• Trust Wallet
• Ethereum
• ETH Foundation