Wallets · 17 / 86 · 2 min
Account abstraction and passkeys
A smart wallet can add recovery, spending limits, and passkeys. Those are useful. They also add a new set of people who can help, and therefore interfere.
Recovery and limits are useful. Each helper is also someone who can interfere.
A worked case
A smart wallet adds a guardian who can recover it. The guardian's email is phished. The guardian rotates the keys. Recovery worked. It worked for the thief.
What changes
You might recover an account with people you named, instead of a seed you must never lose. You might pay gas in a different coin. The wallet is a contract, not only a key.
What to ask
Who can recover it. Who can upgrade the wallet contract. Whether a guardian is a company. A passkey stored in a cloud account ties the crypto wallet to that cloud company.
Easier is not the same as trustless. Read the recovery path before you need it.
A helper who can also recover the wallet for someone else
Account abstraction, and the wallets built on it, let a contract be the account. You can add a spending limit, a passkey, a guardian who recovers you if you lose a phone, and a relayer who pays the gas so you do not have to hold ether. Ethereum's own roadmap describes this direction. The features are real. Each one adds a person or a program that can act.
Recovery is the sharp edge. A guardian who can rotate your keys can save you from a lost phone. The same guardian, phished, bribed, or simply sloppy, can rotate the keys for someone else. A module you added for a game and forgot can keep an allowance. A relayer who submits your transaction can, depending on the design, see it and reorder around it. None of this is a reason to refuse the tools. It is a reason to name them.
Before you turn recovery on, write down who can use it and how you would notice if they did. Convenient and single-key-safe are different sentences.
Read it yourself
These links are the record. They are not a recommendation, and they are not instructions. A news story or a court paper can still be wrong about a detail. The check does not change because a famous name is in the story.
Apply the check
Open a question. The line is about this topic. It is not a verdict that anything is safe.
The relayer, in fees. The guardian, if they abuse recovery.
The wallet contract's upgrade key, and the guardian policy.
The guardian, or a module you added and forgot.
Check yourself
Is a passkey the same as a seed you alone hold?
Not always. It may be tied to a phone maker or a cloud account.
After this you can point at the recovery path and say whether a company is on it.