Ethereum Foundation Access Cluster Releases October 5 Update on EIP-7906 Assertions

On October 5 2026 the Ethereum Foundation Access Cluster published a post on native transaction assertions under the Trillion Dollar Security work. It frames blind signing and transaction uncertainty as a user-experience risk and presents EIP-7906 as one possible approach.

Core Problem Identified

A signature commits to a request yet the outcome still depends on the code and state at execution. The post separates intent mismatch from outcome mismatch. Intent mismatch occurs when the signed request was not what the user believed it to be. Outcome mismatch occurs when the approved request still produced a result the user did not want.

Limits of Current Tools

Clear Signing simulation and contract or wallet guards help reduce risk. None give onchain code a general way to inspect the full set of net state changes and events a transaction produced. This gap leaves users exposed to results they cannot fully verify before confirmation.

Proposed Design Approach

Native assertions would add a signed rule over resulting state. Read-only logic compares start and end values. If the rule fails the actions revert. This mechanism aims to give protocols and wallets a reliable onchain check without altering the core execution flow.

Details of EIP-7906

EIP-7906 adds a read-only POST_TX frame at the end of a frame transaction. Three opcodes support the check. TXTRACE records net state changes and events. TXDIFF reports start and final values for named addresses and slots. EVENTDATACOPY copies event data into memory. Net writes collapse to one start-end entry so a slot that ends unchanged does not appear in the trace.

Failure Handling and Gas Rules

If an assertion fails the execution body reverts. The transaction still stays in the block as failed and the gas payer is charged. Deliberate failing transactions are not free for builders to run. This design preserves economic incentives while allowing assertions to enforce expected outcomes.

Implementation Requirements

EIP-7906 does not force an assertion. Wallets must include the required rule. Protocols must reject calls that lack the exact assertion. Already-deployed immutable contracts cannot add that check so adoption depends on new deployments and wallet support.

Call for Community Input

The Foundation asks for wallet and protocol input at trilliondollarsecurity@ethereum.org and in the EIP-7906 discussion thread. This remains a design post and does not constitute an upgrade activation. EIP-7906 has reached Considered for Inclusion status but is not confirmed for the Hegotá upgrade that includes EIP-8141 frame transactions.