Setting the bar on Ethereum wallets

Transcript

Hello. Hello. Okay. Hello guys. Hello. So, how's everyone? Everyone doing good? Okay. So, good afternoon guys. Uh before I start my presentation, I want to first introduce myself. I'm Michael, one of Wallet Beats contributors. If you've seen me on Next, you've probably seen me posting as MattMath. Okay, so let's talk about Ethereum wallets. First I want to ask two question. Who here has used an Ethereum wallet before? Okay, so it looks like almost everyone here has used an Ethereum wallet before.

And now my second question is who here has signed a transaction before before fully understanding what it does. Okay, I see there's still a few hands. That's nice. So I'll be the first one to admit it. uh I have signed more than one transaction without fully understanding what it does. I know it's kind of embarrassing but transactions such as um unisoft transaction or caus transactions um I think it's quite common in our space right most of us here has used an Ethereum wallet before so that's exactly why wallets matter and other reasons why wallets matter is that number one it holds your keys two it holds your funds

and three and it it enables you to sign transactions so with all of that being said your wallet It should at least be secure, right? I want to ask you guys, what wallets are you using? Please raise your hand if you're using Ampire. Any Amber users here? Okay, I see few. How about MetaMask? Okay, MetaMask, the most popular. How about Rainbow or Krabby? Okay, I see Safe. Okay, so with all of that being said, these are all great wallets. They have been battle tested and these are the wallets we've known throughout the years.

But here's the thing. It doesn't matter if you you have the most secure wallet if you don't know what you're signing. Well, you guys remember the BB hack. $1.5 billion got stolen from Bybit. It was not a vulnerability vulnerability exploit. It was not a smart contract exploit, but it was a result of blind signing. Now this is not an attack on bybit or any of these protocols but because the current wallet landscape makes it difficult for users to understand and verify what they are signing. I think we have a transaction legibility problem. Now what is the transaction legibility problem?

Users do not actually know what they are signing. users experience things like horrible raw call data experience which leads to poor hardware wallet transaction verification and then users would just yolo sign or blind sign. Now luckily for us this is where ERC 7730 and ERC 8213 comes in. ERC ERC 773 7730 helps you understand what you sign. On the left side here we have the raw call data. This is a a supply transaction and on the right side this is the human readable transaction that ERC7730 provides. Users need and want the one on the right and not the

ugly thing here on the left. Right? But the way ERC7730 works is that for whenever a project or a smart contract developer deploys a contract, you would need to register it to a registry which is right now kind of a centralized registry. It's a GitHub repository. Funny story about this is I was actually planning on deploying my own contract and showing it showing how ERC7730 implement implementation works. But looking at how many PRs are still not merged just for uh project registry then I might was as well not. But the key thing is if your project is not registered in the registry means no ERC

7730 implementation and this is where ERC 8213 comes in. ERC8213 provides the call data digest that you can see on the right which is much easier to verify than the 330 character count which is the same a supply transaction we have earlier. I would still consider this as a short call data. Imagine if you're signing things like unisop or even safe transactions then you will probably appreciate the by32 digest right erc 7730 helps you understand what you are signing and ERC 8213 helps you

verify what you are signing the key message is this wallet user experience and wallet security are increasingly becoming problems of standardizations But what if more wallets start to adopt both standards? What do we get? We get better wallet interoperability, better wallet transaction clarity, better user trust and better wallet safety and also better open open competition almost better everything. Now the question to ask is what wallets adopt these standards? What wallets implement certain EIPs or certain ERC's?

what wallet provides basic user safety or user privacy and this is where wallet beat comes in. So wallet beat is a wallet rating system for ethereum wallets. We are the L2B of wallets and we evaluate wallets based on five dimensions security transparency privacy ecosystem alignment and self-s sovereignity. Wallet beat aims to raise the bar and push the wallet ecosystem forward. Now, one of our most recent implementations is now that we're tracking ERC 7730 and ERC 8213 or the wallets that implement them. And alongside with this is we've built a

wallet beat testing playground which you guys will be playing around in a while. I'll be demoing it to you right now. So, to go to the wallet beat testing playground, first you have to go to the wallet beat page. It's beta.wallet beat.o. I know it's a handful. And then afterwards, you navigate to the sidebar, test your wallet. And then before you do anything, you you must connect your wallet.

But please take note that you should you should just use the seed phrase that we've g given you. Uh wallet beat won't be responsible for any losses or any drains. Okay. So, now I'll be doing the demo. Okay. I'll connect my wallet first, of course. Okay. So we have multiple tabs here, but we'll be focusing mostly on transaction simulations and scam alerts. So we have

transactions, signatures, EIP support, app isolation, transaction simulation, scam alerts, and our most recent tab, ERC 8213, which helps you calculate your call data digest and EIP712. Okay. So, what I love about MetaMask is that they handle transaction simulations properly. Let me show you what I mean. Here we have a volatile outcome transaction. And not only does Metamas simulates a transaction for you, but after a while or after a few seconds, it simulates a transaction again. As you can see, MetaMask shows you that you'll

be uh sending 100 tokens, but after a few seconds. Hopefully, it shows there you go. It shows you that instead of u sending tokens, you'll be receiving tokens. And checking out your transa your wallet's transaction simul feature is very important, especially when it comes to transactions that depends highly on variables that that are always changing. So scammers could utilize these kinds of transactions by creating a D app and then letting wallet letting wallets only simulate uh certain block number and will show you what looks like a perfectly normal transaction. Then

during the execution would execute the malicious state. So uh let's move forward to one of the other tabs scam alerts. What I also love about MetaMask is that whenever you're trying to sign an unlimited approval, it shows you a warning. So, it's already 2026, right? So, we unlimited approval is not it's not required anymore. Please ask your wallets to have batch transactions to remove this necessity.

And then one last tab I want to show you guys is EIP support. So this tab essentially tries to scan your wallet if what EIPs do they support. It's quite straightforward. You just have to run through six different steps. I'll show you guys. So run step and on the fifth step it will ask you to sign a transaction. Uh let's just assume that this transaction pushes through and then afterwards it will show you that a test result of what the test has gone through. It will either show you

uh passing rate or a partial rate and a failing rate. So a partial rate means a wallet implements all required and optional features of the certain EIPs. For example, this one EIP 6963 and EIP 11193. The wallet implements all required and optional. And for a partial rate, it means a wallet implements all the required features of the EIP but not all optional features of the AP. And that's okay. And for the failing rate, it means that the wallet does not implement all the required feature of the AAP. Wallet beat only cares about wallets implementing or wallets having a passing or a partial

rate. So now please feel free to work around with the wallet testing playground. Poly mutx will be polyutics will be distributing sheets of paper that has a seed phrase in it. And we've prepared a little activity for you. question.

>> Yeah. >> Sorry. >> Thank you. >> Hello. Uh, hi. Thanks for the great introduction. um you said instead of unlimited approval just ask Wallace to do bash transactions can you explain why that solves uh the issue so if I if I want to give approval so that I don't have to every time I go on cow swap uh approve a specific amount usually I just do unlimited approval and in the future it will just accept my USDC without asking again. Well, yes. Um, I think part of why unlimited approvals was

accepted in the first place was because we were forced to have two different transactions. Before it was approve and swap for unis swap. Correct. But now through batch transactions, we remove that friction of having to approve two transactions by batching them into one transaction. >> Ah, okay. That's what you mean. >> Okay. Thanks. >> Any other questions? Okay. So again guys, feel free to play around with the wallets and and we'll be back after 10 minutes. So I'll be here to roam around and assist you guys as well.

There you There you go.

You guys need any help? >> And I see here a lot of example transaction. >> Uhhuh. >> Oh, maybe the point here is that the way you see it. >> Exactly. Yeah. see how it reacts and any comments, any feedbacks. >> Oh yeah, I think that's because you don't have any USDC. So feel free to swap that. The five I think 0.0058 is all yours. Feel free to play around with it, do swaps, anything you want. >> Do you need anything here? You need any help?

>> Uh play around with the wallet. Okay. So, also visit the quality testing playground and then check just check how your wallets react to different certain scenarios or situations. >> Hello. >> Hello.

>> You need any help? So far so good. >> Okay. So, >> so I loaded one wallet. >> Uhhuh. >> Okay. What's the next step? >> Just play around with the wallet. Actually, that's the whole point of the wallet testing playground. So, I'll >> Okay. Ah, sorry. I did it on a fresh wallet. >> You wanted me to do it within wallet >> or any applications that you want. >> Okay. So, I use Brave wallet. >> Okay. Did you import the keys? >> Yes. >> And does it show that you have tokens? >> No.

>> Okay. So question is why >> can you try the other one? >> Yeah, but uh usually you can have it gives you a lot of addresses. So maybe it's not not detecting the right address where there is >> well so for example with a scene on metamask >> the first default address it will give me might not the one that I actually use.

>> Okay. Yeah. But I >> Did you use this set or Okay. This is Am

I donated? You know what?

Whatever is All right.

Thank you. >> Yeah. One way of thinking And then

everywhere. Hello, hello, hello, hello, hello guys.

Um, hope you guys had a lot of fun exploring your wallet, exploring the wallet testing playground. But for now, let's take a look at the screen again. Okay, so we've discussed earlier both standards ERC 7730 and ERC 8213 and how it helps the you the whole user signing experience but what does it really look like in real life so I'll be doing demo on how it would look like okay so uh context on my the transa transactions I'll be doing is that I'll be doing an a supply transaction through safe multisigs And I'll be comparing three wallets. One one a wallet that does not implement

both ERC 7730 and ERC8213 and another one a wallet that implements ERC 7730 and a hardware wallet that implements ERC 8213 and see how it really improves the whole user signing experience. Okay. So for the first transaction I'll be using Phantom. Um, Phantom has 5 million users for I don't know what reasons actually because you can see in a while what what I mean. Oops, not Amber.

Okay. Okay. So this is the same transaction using now phantom. Okay. So not only it fails to simulate the transaction but also it provides zero data at all. We can see here in the raw call date. We can see here in the transaction details, it only provides the raw call data which users have no idea what they are going to sign or it will be even almost impossible to verify.

But now let's compare it with the wallet that implements ERC 7730 or human readable transactions. Okay. So as we can see here, it's now more understandable and it's now more easier to verify. Correct? So it says here that you're executing a safe wallet transaction, but not only it decodes the safe transaction, but it also shows you that you're going to be doing a supply transaction on a. So this is what users need and this is what users want. And now let's take it a step further and

let's try to verify it on a hardware wallet. Unfortunately for us, we still don't have any hardware wallet that sorry software wallet that implements ERC8213. But let's just use our imag imagination for the in the meantime. Let's calculate our own ERC 8213 digest. This is still the same transaction that I will be signing the same transaction earlier.

It might take me a while. Okay. And now I'm computing the our own call data digest since Amber doesn't have one. Let's just imagine that this call dated digest we have here is implemented in the Amber itself. And now I need someone from the audience to help me verify itself. Any volunteers, please? Any volunteers to help me verify this transaction? It it will be easier. I promise you. Okay. >> Okay. Nice.

What's your name, by the way? >> My name is >> Sorry. >> Hello. Um, my name is Sebastian. >> Okay. Please give a round of applause for Russia. Mike, nice meeting you again. >> Okay. So, have you used a hardware wallet before? Uh I might >> I might you haven't? Okay. So I might convert you. Okay. I'll just scan this QR code here. Okay. So the way verifying transactions on a hardware wallet works normally users would look at this call call data and verify it every character. So you can just imagine how tedious and almost

impossible this process is. Correct. >> Uh doesn't look like fun actually. >> Yeah, exactly. Right. So, and again this is still a short call data. So, imagine uh a longer call data. Right. Almost impossible. So, with the help of ERC 8213, which is this thing right here? Is this better? >> This is way better actually. >> Yeah. Okay. So, can you dictate character by character? >> Yeah, I would be able to do it. >> Let's do it. Okay. I'll place it here. >> Should I read it?

>> Yeah, sure. >> Okay. So, it's 0x0 FD57 BCA 0 E23 2 B D84 A9. So, it continues for a while now, I think. So, >> it's okay. It's okay. Okay. So, the whole You can continue >> once again. >> Yeah, you can continue from A9. >> It should continue. Okay. 7B. uh 187041 F9F19. So I think it's uh yeah should I continue till the end is the goal. Okay.

Okay. Like guys um so listen to me reading numbers and letters today. >> We have we have all the time. 9F1 9 D1 CA563 9E A575 CC1E E 6 CFC 693 0 BBB4 >> Okay, >> I made it. >> Okay, thank you. Thank you again. What's your name again? >> Sebastian. >> Okay, thank you, Sebastian. So while it might look tedious, while it might look tedious, the the way we have it normally works is that before ERC 8213, we have to verify pages of call data. So this is what we have now. And as you can

see, the by32 digest is a much much bigger improvement from what we have originally. Okay, so going back standards like ERC 7730 and ERC8213 aims to improve user experience and interoperability but again standards will be useless if not widely adopted and as part of the ecosystem Wallet Beat will be playing its role to push wallets toward better standards, better

interoperability, and safer user experience. And if you like this workshop, please feel free to follow us on our socials and give us a shout out. And thank you guys. >> Thanks. um because we didn't get that fountain on here. But did you show before that there is a button I can press if my wallet does not have it that it automatically sends a message to the wallet? >> Sorry, >> like I I thought before you were showing something where um if the feature or or like they're not they've not implemented any of these standards. there was something on your website that would allow me to send a message to the wallet

and make them aware of that gap or or >> No, I think what you're talking about is the call data digest that we calculated through the uh wallet testing page. Is that it? >> Sorry, say that again. >> Yeah. So, yeah, I think I think that's it. No, I'm just trying to show the possibilities of what it would look like if a certain wallet implements the standard the Kita digest in which for now we have to improvise. >> Okay. But if I find out that my wallet does not do any of that um through your tools.

>> Uhhuh. >> It like and you say like make sure that your wallet does does have these features. Um are you have to contact them or what's your call to action? Well, um that's exactly the mission of wallet beat is to making these wallets care especially for these standards and value. So we would like your support to rally around the standards. >> Okay. >> Okay. >> I'm afraid that's all the time we have for today. So, thank you once more for a speaker. [applause]