Cross chain Intent + Account Abstraction Audit & Threat Modeling

on YouTube ↗18m

" summary

UMA team's audit finds concrete, reproducible failures in cross-chain Intent + Account Abstraction: a deployed NFT demo reproduces user-operation hijacking (attackers submit signed ops before filler funds arrive), simulation–execution mismatch causing filler gas loss, indexer-allocator races enabling double withdrawals, and partial funding attacks that force atomic failures. Proposed fixes include a guard contract between filler and account, a funding filter contract, allocator checks beyond the indexer, mandatory filler debugging, and a profitability formula; two issues are already reported.

AI-written summary · about

" chapters (6)

1. 0:00Project intro
2. 1:39Cross-chain asset transfers
3. 6:54Threat modeling & vulnerabilities
4. 11:30Off-chain attack scenarios
5. 13:37Vulnerability demo
6. 16:36Project outcomes

" related talks

• 40mAccount Abstraction: Making Accounts SmarterDror Tirosh · Devcon 6
• 18mNot Quite Water Under the BridgeJan Gorzny · DeFi Security Summit 2022
• 16mDiscussion - Security 2, Session 9Tarun Chitra, Mitchell Amador, Mudit Gupta, Nurit Dor · DeFi Security Summit 2022
• 01h 06mAccount Abstraction PanelYoav Weiss, Vitalik Buterin, David Hoffman, Julien Niset · Devcon 6
• 43mOutsmarting Smart ContractsDamian Rusinek · OWASP AppSec Europe 2018
• 28mCross-Contract Ricochet Attacks & Off-Chain-On-Chain Manipulation of Billion Dollar NFT CollectionsNitesh Dhanjani · Black Hat Europe 2022
• 22mAlpha for Auditors: The Vulnerabilities of TomorrowAnton Permenev · DeFi Security Summit 2022
• 18mFavorite DeFi VulnerabilitiesMehdi Zerouali · DeFi Security Summit 2022