Enabling Passkeys and Face-print Logins with Account Abstraction for Non-Custodial Wallets Zhen Yu

small contract wall so I'll call an abstraction so um this is just the first demo of what we did I wanted to show it live but uh I wasn't able to so you guys like I just got to watch this this is kind of like what the experience looks like on a Mac computer so you know it's this it's that tab that we're all familiar with I have basically logged in and you can access your account abstraction wallet and and ethereum and all that nice stuff uh behind the scenes so now everybody loves face slash Touch ID and uh it's not just web 3 for that like face slash Touch ID it's also Apple Google Microsoft they're all shifting towards it um pass Keys is uh part of the web offense standard which is also face search ID um you know web 2 is crazy about it as well it's not just web 3. so let's walk through some of the steps that we had to take to make uh account abstraction or web of then work with sorry web off then work with account abstraction actually meant to have this slide initially but so the face Touch ID uh like API that you guys saw on the browser is actually a web browser API called Web often it's um the organization that pushes us out is the Fido Alliance and I'm not sure if you guys might have heard of that but like apple Google you know Microsoft they're all part of the Fido Alliance and this is a standard that w3c is pushing up now that's also the case of pass Keys how the standard works is like this in this diagram over here let me just walk you guys through that this over here so there's a relying party or server you can think of that as a you know adapt server it's server side a backend then there's the user's front end over here and you have this is in the browsers context so you have the JavaScript site and then you have the browser and then finally you have to authenticator the authenticator most commonly is either your max Hardware secure Enclave chip or if you're using a phone the same thing it's the secure mobile Enclave that's on your like phone and chip so what happens is web authen right is really just an API that allows your uh a authenticating relying party server to access the authenticator via submitting a challenge right and getting that challenge signed by the key pair which is held on your mobile secure Enclave now and then it goes back and you can verify that the signature is correct and yada yada yada you're done so how do we throw this into a small a a current instruction implementation now taking the same so I just drew this out so this is what the first implementation that somebody might typically Implement right um the user the relying party server which is again maybe the wallet server or the wallet backend sends a challenge but this challenge instead of it just being a random string or something of that sort we instead submit onshade verified attention so assume we have a smart contract wallet that's already deployed right that's assigned to you know the hardware Enclave I'm skipping registration here I'm just talking about pure siding but we like like then as in and like typically what we'd submit is a challenge but what we can instead submit is like saying hey smart contract please send my usdc to you know uniswa or something like that or please take or something like that that's this unchain verified uh intention right and we'll send this through all the way to the hardware enclave and the hardware Enclave will sign on that with its own public private keypad and give the the the the signed signature back to the railing party and server we then this this signature though is not compatible with a theorem it's not the sccp 256k1 curve it's not compatible with that ed25519 as well so not compatible with some of the newer l1s or alternative l2s not compatible stock net not ZK sync as well so we can't use this in the Raw what we instead have to do is we have to wrap up there we have to wrap this transaction so it's a valid ethereum transaction and then we then submit it and we pay for it on that user's behalf and we submit it to the user I mean on behalf of the user now with this naive implementation can anybody spot what is wrong with this implementation trusting the server that is one thing but it's not the critical thing that's the problem here that that is a problem but it's not a critical thing that's a problem it's about Mev does anybody know yes sir it is that's it it's a re-entracy or replay attack so in particular right now all we are signing over here is my intention to send usdc to uniswap right so what that means is that that that object this attested object that comes back is actually representative of my intention and I can just submit that that it can be a replay attack attackers can take that and submit that again and again again but secondly uh it's really just simply uh it's really just simply secondly it's reasonably like a minor can front run me and uh and choose to do it ahead of time before I do right so that's the naive implementation but a proper implementation so this doesn't work indicated by the Red X as you can see now like uh so we need to prevent we need to uh secure against front running or re-entracy attacks and how we do that is very simple just like how nonsense are used in transactions today we just add a nonce onto the smart contract wallet or the account abstraction layer and and then we also use this month over here so each transaction can only be signed once and each transaction can only be used once right so this is a working implementation and that's what we've done and um we'll have an SDK out for you all to try it out like down the line well in particularly there are some drawbacks this isn't like like this feels nice and seems cool but what are some of the you know limitations that we are facing today with face slash Touch ID why isn't it all over the world and used by everybody so the false problem um that we've encountered whilst testing this and implementing it and testing of some users is that the first thing is web often keys are device specific right so it lives on your phone or lives on your laptop meaning you know this is like how if you lose your laptop in the sea your metamask key is lost then you have to go back and hunt your seed phrase this is the same thing is true with uh with web often your you lose your phone in the sea and you've lost your wallet right so um yes there's pass keys and apple Microsoft are pushing out pass Keys quite strongly in particular but compatibility and what pass Keys really are is they use either your Apple login or your Google login to copy the hardware Enclave key and then share it around in some way or form right and um and uh there's some questions about whether that's truly self-custodial uh and then there are also questions about like um and there are also issues just about compatibility right a lot of your mobile devices especially Android aren't compatible with power skis today even in the Apple ecosystem the older iPhones and all aren't as compatible today so you'll go face if you try to use this in a mainstream flow you're going to face a lot of issues with Device compatibility um another disadvantage is uh there are extra costs for on-chain verification and signatures and transactions in general that's true for smart contract wallets or a construction in general as well but it is are further exemplified with pass keys because you're actually verifying a signature which is a very unique and weird key type often like not you know it's a very unique key type that's being verified here um and finally uh this gentleman added previously that uh server side risk is an issue and that is true so web authen keys are also specific to the application or the relying party server meaning if there are two different applications or two different wallets the user actually has two different Hardware Enclave Keys which are kept on the mobile device what this means if that is if that relying party server of that back end goes down you have the key on your phone but you there's no API to ever retrieve whatever sign or use that key it's a huge risk right so those are some of the drawbacks here um what's next and what's interesting for us though there's a lot of things to be positive about pass keys will eventually be popular and hopefully we get and reach that state um but before that these are some interesting things that we are pursuing at least that web3 off so can we get a web often working a little bit better by hacking the authenticator level so um you know how polygon is launching like the one phone um uh the nothing phone sorry um web3 office walking with polygon and polygons ZK chains to uh to in particular try to implement um on the authenticator level a more friendly version of pass keys and also um make it a little bit more compatible with the browsers uh the second thing is perhaps we can bypass web often all together and not use that standard perhaps we can actually Implement these signature verifications and these key type verifications that we get on today's Hardware enclaves like in the protocol level itself so on the on on chain implementing the signature verification of light the the curves which are supported by the hardware enclaves today um and we're also doing that with the Solana Foundation uh and the Solana Saga phone although I think not many people like Solana here but they have a phone and that's why we're working with them um so yeah that's about it uh I'm gonna take an opportunity to kind of uh show a little bit more about us and you guys can reach out to us to find out more about our past key Endeavor and our face Touch ID Endeavor um please feel free to reach out to any of one of these contacts over here my telegram isn't here but like you can meet me afterwards uh go take the last five minutes for Q a but for Q a I'm going to show a little bit I'm from web3 off and we do cool stuff like this we also do um you know lots of account instruction stuff as well as MPC stuff and we like to marry Both Worlds we provide wall infrastructure for some of the top wallets in the space today and if you guys are looking for things like really accessible wallets or to build a wallet please hit us up thank you any questions q a yes sir so the question was what are we known for for account obstruction today um I think in particular we aren't one of the 4337 evangelists um we've done several implementations on different chains in particular to kind of like estimate gas costs and usability acquisition user acquisition costs of 4337 are still a little bit high as I'm sure you're aware 25 on mainnet oh it's ridiculous even on stock net it's like 50 cents in particular for per user right so um I mean we wept it off also um we work with a lot of account abstraction sdks so we announced I'm not sure if you guys heard of safe's new SDK announcement safe core web through off is bundled in that SDK we also Power by economy which is one of the leading construction sdks use keep Xerox pass you know the only seven out there and like five of them are integrated with yeah please unless anybody else has a question yeah please go ahead dude so we are exploring and we are also working with partners yes sir unless you want to go first you're in the queue yeah my quest my question was about the weather 4337 helps with uh step six on that diagram uh it does in that in standardizes a gasless alternative but at the same time you also don't have to use that standard and a lot of them like for example gelato Network and by economy they just ignore it in particular oh I see I see on the construction level um I would need to dig further into that in particular I'm not super familiar with the exact EIP e uh you sir you uh briefly mentioned NPCs uh how is it integrated uh today or in the future uh so the question was MPC and how is it integrated with our infrastructure in particular web through-offs like um you know every account abstraction or every smart contract wallet needs an eoa in particular right uh web 3 off eoa is via MPC what we do is basically split a user's poly private keypad up into multiple different parts and then secure it with factors that they already own so these include like their phone their devices but also includes like um their emails social logins and whatnot so we combine these multiple factors into a two-factor wallet or multi-factor wallet um powered by NPC are there any other questions we have about like a minute a couple of minutes left all right okay thank you guys [Music]