Watch Out For Account Abstraction in 2023

Current Model: Externally Owned Accounts

Ethereum today has two types of accounts:

Externally Owned Accounts (EOAs)
- These are the wallets that you and I typically use.
Contract accounts
- Smart contracts (e.g. an ERC-20 token, a staking contract, Gnosis Safe etc) that are governed by code. Contract accounts cannot initiate transactions themselves.

A key issue with EOAs is that if the user forgets their password/seed phrase the account is lost forever.

In addition, if someone gains access to your keys, they have total control over the account. These accounts leave no margin for error and have been the cause of significant losses.

Furthermore, EOAs have very limited functionality and cannot be customized.

Due to the total consequences of self-custody and the really poor user experience using wallets, many have been deterred from using the blockchain and have stored their funds on apparently reputable exchanges such as BlockFi and FTX, which subsequently went bankrupt.

This leaves us in a situation where:

Having funds in self-custody is highly risky and problematic.
Depositing funds with third-party entities has a very poor track record e.g. Mt Gox, FTX, various hacks etc.

As long as the current situation continues, Web3 will not achieve anything close to real mass adoption.

Account Abstraction

AA unifies EOAs with contract accounts, meaning that wallets can have customized functionality. This opens up a range of security and usability improvements for users.

Ethereum has been looking to implement AA since 2017; however, it is a very challenging undertaking that has been sidelined in favor of the scaling roadmap. That said, L2s such as StarkNet, zkSync, and Fuel are incorporating AA by default.

This report focuses on AA in the context of L2s.

Greater Security

There is no safety net for performing on-chain transactions. They are immutable, and any wrong move could completely drain your wallet. AA can provide multiple layers of security to avoid these things from happening and bring wallet user experience in line with that of Web2.

Social Recovery

One of the key barriers to crypto adoption has been the absolute consequences of forgetting or having your seed phrase stolen. AA enables Social Recovery which can overcome this problem.

Essentially, a wallet holder can nominate ‘guardians’ to change their key and recover their wallet in the event that they forget their password / private key.

‘Guardians’ may be:

A trusted friend/relative
One of your other wallets e.g. your hardware wallet
A third-party service
Or even a combination of the above.

Note that a guardian never has access to the assets in your account.

Example: Chad forgets his password to his wallet. Luckily, he has nominated three guardians. He can contact two of these guardians and ask them to sign a transaction that will enable him to recover his wallet. His guardians are:

His hardware wallet
His close friend
A third-party service e.g. Argent

Social recovery allows users to retain self-custody of their funds without the total consequences of losing their private key. Vitalik Buterin is a strong advocate for social recovery and has said it is his ‘preferred method’ for securing a wallet.

Wallet Contract.png Vitalik Buterin

Two-Factor Authentication ++

AA enables wallets to require multiple signatures to execute a transaction; while this seems like your standard multi-sig, customisation possibilities make it potentially far better. For example, you could have a wallet operate similarly to 2FA where the keys of your account is managed by a service that only executes transactions once you have confirmed by email/SMS (similar to typical financial applications today). This is very similar to the user experience people are used to and will be a critical component to the mass adoption of Web3 technologies.

Ultimately, it can be configured to varying degrees of self-custody and control depending on the user’s desires and needs.

Defining Security Parameters

Daily Transaction Limits When private keys are compromised, the general outcome is that the wallet is drained at once by the hacker. However, with AA, this situation can be avoided by incorporating security parameters such as a daily transaction limit.

Suppose the user would like to exceed their pre-defined limit. In that case, they can have a 2FA-like system where they have to confirm via their hardware wallet (or another ‘guardian’) that they would like to send additional transactions or transactions above the stated limit. This would make using hot wallets much safer and reduce the need to always use hardware wallets (which have a cumbersome user experience).

Screening Non-Verified Tokens Interacting with non-verified NFT collections can trick people into paying huge sums for worthless NFTs, and interacting with unverified tokens and contract addresses can cause people’s wallets to get hijacked and their funds drained. A live list of verified tokens/NFTs could be leveraged so that any time a user tries to interact with a token/NFT outside of this list they are notified and must confirm with their nominated guardian.

Greater Usability

One-Click Transactions

Another frustrating user experience issue is the need to approve multiple transactions when trying to perform an action. For example, depositing and borrowing from a borrow/lending protocol like Maker or Compound requires multiple transactions - and multiple instances of gas costs. With AA, these transactions can be batched, therefore, greatly simplifying the user experience.

Argent has demonstrated this in practice with Uniswap V3.

image (10).png

Fees In Any Token

AA can enable the payment of gas fees in any token. This means that a user would not necessarily need to hold ETH (or an L2 fee token), and whatever tokens it had in the wallet could be used to pay gas fees (and converted to ETH or alternative fee token in the background).

Session Keys

Games that use blockchain technology will never succeed if users are required to manually confirm multiple transactions during gameplay. This is where session keys come in, where no transactions need to be approved, and everything can occur as it would in a typical game. Wallets can pre-approve certain rules for interacting with dApps so that you can use it as frequently as you like without having to sign transactions. This can be within specified boundaries to minimize any potential risk. The use case of this is not necessarily confined to gaming, although it is the most obvious use case. Session keys are being used and experimented with on StarkNet with Argent X.

Enterprise Applications

VISA

Visa published an interesting thought piece on using AA on StarkNet for recurring payments from a self-custodial wallet. Visa built out an autopayment application on StarkNet with the Argent wallet. The smart contracts were deployed and tested on a private chain.

It is significant that Visa is thinking of integrating with StarkNet for autopayments. This is a rare case of blockchain technology providing an objectively better solution than the status quo and addressing real issues - and all because of AA. This is a powerful example of how AA will be key to the growth of crypto going forward.

Sub-Account Example (Netflix)

Another enterprise application suggested by Ramon Canales of zkSync is Netflix accounts. For a family account, AA would enable sub-accounts where the main account could configure what the sub-accounts could watch (children). While this does not suggest that AA and blockchain wallets will take over Netflix, it is a good demonstration of what is possible with AA in the future and how mainstream companies can use it.

Another potential feature of AA is time-bound transactions - where the user can create a transaction that executes at a specified future time.

Risks

The purpose of AA is to reduce complexity and risk for users, as well as enable improved and new user experiences. However, features will also need to be properly audited in order to ensure the code is secure. If smart contract wallets have poor code, it could have disastrous consequences. It is important that features are not rushed and are rigorously tested before being deployed to potentially millions of users.

Key Projects

Argent

Argent has been live since 2018 and is a pioneer in the field of AA. It has a vault account for Ethereum L1 and has supported AA features such as social recovery, multicall, session keys, and fraud monitoring since launch. This is interesting, as AA has been live on L1 but has not gained significant traction as (1) the network is designed for EOAs and (2) contract accounts on L1 incur higher gas fees.

Argent is currently building wallet solutions for both zkSync and StarkNet (with both networks supporting native AA). Argent is a non-custodial wallet with no seed phrase. Accounts are accessed with a password or face/fingerprint ID from a smartphone. Users can nominate guardians for Social Recovery. Users can catch a glimpse of what Argent is like by downloading the mobile app (which is for zkSync 1.0). Argent may likely be the first mass-used contract wallet following the launches of StarkNet and zkSync. The functionality of Argent will likely improve over time.

Website

Twitter

Braavos

Braavos is building a smart contract wallet specifically for StarkNet. It will be interesting to see what progress they make and the features they introduce this year. They announced their seed round on 31st October 2022, raising $10m.