When someone initially desires to become involved in decentralized finance, NFTs, or any other form of on-chain activity, they are confronted with the reality that they must first get a wallet. Unfortunately, the experience of using an on-chain wallet is quite different from what most people are used to. This is a big stumbling block for millions of prospective cryptocurrency users.

While wallets provide the user complete control over their funds, they lack the security features seen in other online accounts. Users must keep their private keys/seed phrases secure or risk losing their digital possessions. This is not like a bank account or even a centralized crypto exchange account. For example, Coinbase and almost every other centralized account allow customers to use 2FA to protect their money. No on-chain solution presently supports this sort of capability. The absence of fundamental security features discourages retail consumers from considering on-chain apps, forcing them to rely on centralized and custodial wallets. As we just discovered, this is not always the safest choice. The collapse of organizations like FTX, BlockFi, and Celsius, and the subsequent loss of user funds, has reinforced the argument for keeping your assets in your own hands. Retail customers, on the other hand, need a simple means to do so. How may the existing paradigm be altered? We can tackle many user experience difficulties by upgrading our wallets into account abstraction wallets.

The problem with the current wallets

To implement self-custody wallets on-chain, you'll need either an externally owned account (EOA) or a contract account (CA). Both are capable of delivering and receiving digital assets as well as engaging with smart contracts that have been installed.

Currently, contract accounts are exclusively used for self-custody in the form of a multi-signature wallet, or "multi-sig." Multi-signature wallets provide increased security but are often not a viable option for retail consumers to maintain their assets on-chain since they are significantly more difficult to set up than a standard EOA wallet. Contract accounts cannot be utilized as the main means of storing digital assets without account abstraction.

For anything to be regarded as an "account," three fundamental characteristics must be satisfied. These criteria must be satisfied whether the account is externally owned or a contract account. An account must include the following:

Balance — This is the total number of digital assets in the wallet.
Once — This guarantees that each transaction emitted by the wallet is unique.
Address – This is a unique identifier for each network account.

While both kinds of accounts seem identical on the surface, the main distinction is that an EOA is required to sign every on-chain transaction. Because of this, contract wallets cannot yet be utilized as a full alternative. An EOA wallet is owned by the user through a pair of keys, a public and private key. This pair of keys is referred to as the signer. The address of an EOA wallet is obtained from the public key, and transactions from the account must be signed using the private key. To begin transactions, contract wallets do not contain a pair of keys. This highlights a severe weakness in externally owned accounts. EOA wallets function as both an account and a signer. This causes users headaches and perhaps catastrophic issues.

>>> You might also concern: 7 best Web3 wallets for investors to use

Issues with the EOA model

While it would be deceptive to claim that the present EOA design (which is now the norm for wallets) is fundamentally defective, it is not in a condition that billions of people across the globe can utilize. The key reason for this is that the account is completely in the signer's control. You lose your account if you lose your signer. If your signer is compromised, they have access to your account. While this may be effective in holding a user's possessions under ideal circumstances, we do not live in a perfect world. EOA wallet security is solely dependent on users maintaining a single private key. There is no safety net; no errors are permitted. People make errors, and wallets cannot be this sophisticated if they are to grow to the masses.

Is account abstraction the answer?

The purpose of account abstraction is to separate the signer's connection with the account. An account abstraction wallet is a smart contract wallet that determines what constitutes a legitimate transaction based on predefined and customized criteria. The purpose is to prevent a signer from having complete and ultimate control over the assets in a wallet. Account abstraction blends EOA accounts and contract accounts into one; smart contract wallets will be able to function as separate wallets. This is not currently allowed since all transactions must come from an EOA address. However, with each ongoing EIP, we get closer and closer to the reality of account abstraction.

It has long been assumed that a network-wide upgrade is required to adequately implement account abstraction and remove the requirement for EOA accounts. Vitalik and other Ethereum core developers have been working on options for how this shift may appear since 2016. These are outlined below:

EIP-86: Proposed by Vitalik Buterin in 2016, less than a year after Ethereum's initial release, this EIP introduced the concept of smart contracts as "forwarding contracts" and would only accept transactions coming from an "entry point" address, which anyone could send transactions from if they followed a specific format. This needed significant modifications to the Ethereum protocol and was abandoned.

EIP-1014: Proposed in 2018 by Vitalik Buterin, this EIP adopted key concepts from EIP-86 and resulted in the invention of the CREATE2 opcode. This enables us to forecast where a contract will be deployed without ever having to deploy it. This is significant because, for a smart contract wallet to operate, we must ensure that the smart contract address is the same on all EVM chains, even if they were not all deployed at the same time.

EIP-2938: Proposed by Vitalik Buterin, Ansgar Dietrichs, and Matt Garnett in September 2020, this EIP tried to create new "account abstraction" transactions, which necessitated the construction of new opcodes. This proved to be too significant a procedure alteration, with unknown consequences. EIP-2938 was abandoned.

EIP-3074: Developed by Ansgar Dietrichs and Matt Garnett in October 2020, this EIP included two new opcodes: AUTH and AUTHCALL. They enable a smart contract to send a transaction on behalf of an EOA when used together. Significant network modifications, as witnessed in previous EIPs, are unlikely to be accepted. EIP-3074 was no exception, and due to concerns about its security hazards, it was never adopted.

It's worth noting that the history of EIPs demonstrates that account abstraction has been on the minds of key Ethereum developers from the beginning of Ethereum. With The Merge accomplished, additional development efforts can now be directed toward account abstraction. The new EIP takes us closer to next-generation wallets.

Account Abstraction in Ethereum without needing consensus-layer protocol changes: EIP-4337 Vitailk, OpenGSN, and Nethermind proposed EIP-4337 — Account Abstraction through Entry Point Contract Specifications — in September 2021. The EIP seeks to provide account abstraction without needing modifications to the core protocol. This is a big victory since procedure adjustments have stymied most progress so far. Although EIP-4337 is still in the draft stage and has not yet been completed, there are already implementations of it available, such OpenZeppelin and Stackup, since it will not modify the consensus layer. This EIP function's mechanisms may be divided into three steps:

UserOperations (basically standard transactions with additional data fields that enable account abstraction capabilities) are routed via a customized mempool.
Following that, UserOperations are combined into a single transaction using a Bundler. Bundlers would choose which UserOperation objects to include depending on fee-prioritization logic, much as miners do in the present transaction mempool. The bundler (through a service such as Flashbots) requests verification from an EntryPoint contract.
If there are no mistakes, the transactions are added to the network's next block.

entry point contract

Source: Substack

The EntryPoint contract is an important piece of infrastructure that is accessed via the Bundler. This smart contract is invoked to check that the UserOperations meet the account's predefined rules before executing them. It is critical to recall that EIP-4337 contains no protocol-level modifications. Bundler is an EOA address, which is reporting all of these transactions to the chain. By adding a Paymaster, the EntryPoint contract may be expanded even further. The Paymaster provides the following advantages:

It enables app developers to pay fees on behalf of their customers.
Users may pay fees in ERC20 tokens, with a contract acting as an intermediary to collect the ERC20s and pay for gas fees in ETH.

This is a huge benefit for app developers that do not want their users to pay for network expenses. Users will be able to pay in various tokens straight to a 'paymaster,' who will convert it to ETH for system compatibility. This is only one example of a distinct advantage that account abstraction wallets offer over EOA wallets, and there are many more to discuss.

Account Abstraction use cases

Changing wallets into programmable smart contracts enables additional capabilities. The advantages and additional use cases of having an account abstraction wallet are so compelling that most users should consider moving to one. It is comparable to switching from an outdated Nokia phone to the most recent smartphone.

eoa vs smart contract wallets

Source: Argent blog

Social recovery

Social recovery, one of the most essential advantages in terms of protecting a user's digital assets, attempts to safeguard users if they lose their signature key. Consider what would happen if a user's laptop crashed and they lost their physical copy of their private key or seed phrase. With an EOA wallet, all of your valuables would be gone permanently in this circumstance. Social recovery uses a different strategy than utilizing a seed phrase to recover a wallet. This is Vitalik's preferred method of wallet security, and he explains how it works below:

To authorize transactions, a single "signing key" is available.
There is a group of "guardians," and a majority of them can work together to modify the account's signing key.
If a user loses or forgets their signature key, the social recovery feature may be used. Normally, if you lost both my signing key and your seed phrase, you would be unable to access your account. With social recovery, the user simply contacts their guardians and requests that they sign a certain transaction to change the signing key recorded in the wallet contract to a new one. Although there are some technical variations, this is fundamentally similar to what occurs when you forget your Google account password and need to re-enter it.

There are several options regarding someone to appoint as a guardian. The three most prevalent alternatives are:

Other devices held by the wallet holder's Friends and family members Institutions, who would sign a recovery message if they received confirmation of your phone number or email, or maybe in high-value instances, directly verify you via video call
Adding additional guardians is a rather simple procedure.
The UniPass Wallet is a new smart contract wallet that includes social recovery as one of its primary features. The UniPass Wallet features a user interface for adding and removing guardians.

Access control based on roles

The platform's creators need users to implement 2-factor authentication (2FA) for many standard "web2" apps. This prevents a large number of hacks from occurring automatically.

It is worth mentioning that many other publications will state that having an account abstract wallet unlocks multi-factor or 2-factor authentication by SMS or email address. This kind of 2FA is often implemented using Multi-Party Computation (MPC) and an off-chain server. There has yet to be an entirely on-chain implementation. However, since it is driven by MPC technology, it may easily be built with simply an EOA wallet. To claim that it is exclusive to account abstraction wallets is deceptive.

Smart contract wallets, on the other hand, may offer a similar sort of functionality on-chain by necessitating the usage of your hot wallet as a form of secondary confirmation. This immediately stops a large number of hacks from occurring since even if you have been phished, you may still need confirmation to shift your assets. Account abstraction wallets allow you to set individual security measures according to your needs. As an example, consider the following:

Setting a daily transaction limit, which defines a monetary restriction on how much money may be transmitted each day unless you confirm through your hardware wallet. This would save your wallet from being completely depleted at once.

Connecting to a database of well-known "scam" addresses, which will ask you to confirm a transaction using your hardware wallet if the address you are communicating with is in the database.

Checking Opensea collections and informing you that you are acquiring a non-verified NFT collection and requiring you to confirm through your hardware wallet, avoiding misunderstanding over purchasing a fraudulent NFT.

Most significantly, while executing on-chain interactions, all of these characteristics create a multi-layered safety net. The vast majority of users have no understanding of what they are signing or accepting. We now operate on a system in which a single misclick may quickly drain your wallet's balance, and this has to change.

Session keys

Many people believe that blockchain gaming will be the next big narrative in web3. This will require a better user experience than what is currently available. It makes no sense for a user to have to accept several functions every time they want to interact with anything in a game. This is not how regular games operate, and the unfamiliarity and roughness of the UI will put players off. Session keys enable users to pre-approve an application's transactions based on a set of criteria, such as a defined time, a maximum quantity of gas, a maximum transaction volume of a specific token, or a specific function on a specific contract. A user would be able to pre-approve their session with a few simple phrases, push start, and play the game without continually being prompted by their wallet to "confirm this transaction."

Transactions in batches

If you wanted to utilize a decentralized application right now, you would have to create a new transaction for each on-chain interaction. This is both inconvenient and costly since each allowed interaction costs money. Wallets may use an account abstraction account to group many transactions together and execute them as a single transaction.

This vastly improves the user experience. Complex transactions and yield farming possibilities may be reduced to a single button click.

Other applications

The functionalities that an account abstraction wallet can enable are almost unlimited. Account abstraction wallets are smart contracts, therefore, wallet developers may continually add new features and usefulness to them. Third-party wallet plug-ins are also possible. This takes me to our second point: the shortcomings of today's account abstraction wallets.

Problems with account abstraction

Account abstraction wallets are not presently implemented at the protocol level and exist solely as smart contracts, with gas transferred in novel ways. Some complications emerge because these wallets are smart contracts. First, because the smart contract wallet uses blockchain storage, there is a cost to deploy it. This may now be avoided by utilizing cheaper chains or having a relayer pay the fee. However, this does not eliminate the increased gas fees associated with filing a transaction. The gas cost for a single transaction sent using a smart contract wallet is higher than the cost for sending through an EOA wallet. While effective batching of transactions might improve this one day, we are not there yet. A second, more serious problem is that each wallet must be examined before it can be used to replace EOAs. If a widely used smart contract wallet has an exploit, it might be one of the most massive hacks in history. Smart contract wallets have been hacked previously, so this isn't just hypothetical. The Parity smart contract wallet was hacked in 2017 for 150,000 ETH (equivalent to 180 million USD now). Three months later, the same smart contract was hacked for another 500,000 ETH (now worth 600 million USD). Fortunately, we've strengthened our security standards since 2017, and much of what account abstraction wallets now attempt to do isn't very complicated. Security measures such as social recovery and role-based access control are also included by default, providing some protection against any faults with the smart contract itself. However, even with these features, the current implementation of ERC-4337 has security flaws. The most serious concern is the EntryPoint contract's extremely high privilege. If this smart contract has security flaws, hackers might use it to compromise any ERC-4337 contract wallet.

In addition to security concerns, the infrastructure required to implement ERC-4337 is lacking. The present ERC-4337 implementation is mainly reliant on Flashbots. Flashbots are critical to account abstraction since it combines a collection of UserOperation objects into a single "bundle transaction" that is subsequently included in an Ethereum block. Because Flashbots are unique to Ethereum, it is unclear how ERC-4337 wallets may be compatible with other EVM chains. While the contract wallet may be deployed on another chain, it would be useless without a method similar to Flashbots for bundling transactions. Finally, smart contract wallets may only connect with decentralized apps that have implemented EIP-1271, which is used to validate contract wallet signatures. The smart contract wallet will be deemed unusable if Opensea or any other decentralized application has not yet implemented EIP-1271.

Established smart contract wallets, like Argent, did not abandon ERC-4337 for no reason. Layer 2 networks are starting from scratch to apply protocol-wide improvements to address concerns presented by ERC-4337.

Layer 2 networks are built from the bottom up and can more readily adopt improvements since they start with a clean slate in terms of technical debt. Zksync and Starkware are both Layer 2 networks with account abstraction built in at the protocol level. Unlike Ethereum, Zksync and Starkware do not differentiate between smart contracts and EOAs, and the two kinds of wallets are combined into one. Layer 2s have achieved genuine account abstraction beyond what any EIP has ever accomplished. These accounts, like an EOA, may begin transactions, but they can also include arbitrary logic, like a smart contract. These designs are fairly close to the one outlined in EIP-4337. Layer 2s may be the ideal spot to onboard the next billion web3 users, due to lower costs and the convenience of establishing and managing a wallet. However, what if we wanted to use an EIP-4337 wallet on Ethereum in the meantime? What is the finest wallet for this purpose?

UniPass - an account abstraction wallet

While Argent wallet (an amazing account abstraction wallet) focuses on layer 2s like Starknet, we must see layer 1 implementations like Ethereum. UniPass is an account abstraction wallet that is developing several features that distinguish it from the competition, which includes both EOA wallets and other account abstraction wallets. When UniPass users begin a transaction, a third party is required to serve as a relayer for it to be completed. The relayer may enable users to spend any supported tokens to pay for the gas fee, or even pay the gas fee for the users, resulting in a gasless user experience. UniPass will supply you with a default UniPass Relayer Node that you may use right away. UniPass Relayer will first take gas payments in the form of its native token and mainstream stablecoins. Applications may also create their customer relayer to match the demands of their user base.

unipass wallet

Source: Unipass

Other smart contract wallet solutions often depend on EOA wallets to maintain private keys. UniPass Wallet employs an MPC-based Threshold Signature Scheme (TSS), allowing it to rely on EOA wallets for security and availability while avoiding private keys, the most common single point of failure, throughout the user journey. This results in a user experience that is both enjoyable and secure for the users.

UniPass also includes a one-of-a-kind on-chain email-based social recovery verification technology. Email protocols (POP3, SMTP, and IMAP) have been around for almost 50 years and are an essential component of the current internet. DomainKeys Identified Mail (DKIM) was created in 2004 to safeguard emails against malicious alteration. DKIM is a standardized email identity verification mechanism. Senders may include a digital signature in their outgoing emails. When an email server gets signed emails, it can determine if the email came from the intended sender and whether the content has been altered.

Following extensive research, UniPass Wallet can now verify DKIM's digital signature using on-chain smart contracts. Users may maintain their non-custodial contract accounts and conduct social recovery using simple emails. Typical social recovery solutions for smart contract wallets, such as Argent's, require guardians to be Argent users or to already have an Ethereum wallet. This implies that if your trustworthy family members and friends are not web3 users, they cannot serve as guardians for your account. With UniPass's architecture, users may designate numerous email addresses as account guardians, allowing them to set up account recovery by simply sending emails to an on-chain smart contract. This significantly reduces the boundaries for guardians and enables all of your relatives and friends with email addresses to become guardians of your account.

But one question remains: how will UniPass keep all of this information private? It would be undesirable if an email address associated with your account was exposed to everyone on-chain. As a result, UniPass Wallet employs zero-knowledge technology to fully anonymize users' private information on-chain, allowing for decentralized verification while safeguarding users' privacy.

Bottom lines

As major centralized custodial wallet solutions fail, many users are flocking to self-custodial wallet solutions. To grow to the next billion users, EOA wallets must develop into account abstraction wallets. They simplify the onboarding process, boost security, and vastly improve usability. While we must continue to depend on layer 1 solutions to transmit gas in novel ways, layer 2 solutions such as Starknet and Zksync will achieve account abstraction in their purest form. This significant UX upgrade might potentially aid in network expansion. To properly execute EIPs that modify Ethereum's underlying protocol, the Ethereum community must actively monitor how this plays out. Regardless, wallets like UniPass are taking the initiative and developing complex wallets using EIP-4337. We look forward to the day when these solutions are widely utilized, and we look back and marvel at how we ever stored our digital assets in such an outdated manner.

Disclaimer:
This article is intended for and only to be used for reference purposes only. No such information provided constitutes advice or a recommendation that any investment or trading strategy is suitable for any specific name.

Account Abstraction: Wallet tech's endgame