Skip to main content
Important: We do not provide financial advice or custody funds. All transactions occur on third-party platforms.
CryptoBipto
Log in

Session Keys, Social Recovery, Multi-Sig UX

What you can actually do with a smart account: scoped session keys, guardian-based recovery, passkey authentication via WebAuthn and RIP-7212, and the modular architectures (Safe, ZeroDev Kernel, Coinbase Smart Wallet) that ship these features at scale.

30 min · expert · part of Account Abstraction & Wallet Engineering

From Infrastructure to Experience

Lesson 2 covered the plumbing of ERC-4337. Lesson 3 covers what users actually feel. Once an account is a programmable contract instead of a single private key, the design space of "how the user interacts with their funds" opens up dramatically. Three patterns have emerged as the dominant value props: session keys (sign once, then act many times without re-prompting), social recovery (replace the key without a seed phrase), and passkey-based signing (use Face ID instead of typing or scanning a hardware device). These features sound straightforward but each required real engineering work to ship. Session keys need a permission model that is expressive enough to be useful but constrained enough to be safe. Social recovery needs a way for guardians to coordinate without creating a new central authority. Passkeys need the on-chain account to verify a signature scheme (secp256r1, also called P-256) that Ethereum did not originally support. This lesson walks through each pattern, the production wallets that ship them today, and the modular smart-account architectures that have made them composable. The wallets covered include Argent and Argent X (the original consumer AA wallets), Coinbase Smart Wallet (launched June 2024, passkey-native, EntryPoint v0.6 with passkey ownership), Safe (modular institutional standard), and ZeroDev Kernel (the leading modular account framework underneath many production wallets). By the end you should be able to look at any smart-account product and identify which of these patterns it implements and how.

Also in this lesson

  • Session Keys: Sign Once, Act Many Times
  • Social Recovery: Killing the Seed Phrase
  • Passkeys and WebAuthn: The Biggest Mobile Unlock
  • Modular Smart Accounts: Safe, ZeroDev Kernel, ERC-7579
  • What This Adds Up To

Key terms

Session key
A temporary, scoped signing key authorized by a smart account with constraints on allowed contracts, function selectors, parameters, spending caps, and validity windows. Lets users (or apps) sign once and execute many subsequent operations within the granted scope.
Social recovery
A recovery model where the smart account designates a guardian set (e.g., 3-of-5 of friends, hardware wallets, institutional services) that can together replace the active signing key after a timelock. Removes the need for seed-phrase storage by the user. Pioneered by Argent in 2018.
Guardian set
The list of addresses authorized to participate in social recovery for a smart account. Can be rotated (carefully) and typically requires a quorum (e.g., K of N) to authorize a key replacement.
Passkey (WebAuthn / FIDO2)
A hardware-backed credential stored in the device Secure Enclave / TPM and unlocked by biometric (Face ID, Touch ID, Windows Hello). Signs using secp256r1 (P-256). Syncs across devices via iCloud Keychain or Google Password Manager.
secp256r1 (P-256)
The elliptic curve used by WebAuthn passkeys, distinct from secp256k1 (Ethereum default). Verifying P-256 signatures requires either a dedicated precompile (RIP-7212 on L2s, EIP-7951 proposed for L1) or expensive Solidity emulation.
RIP-7212
The Rollup Improvement Proposal for a secp256r1 verification precompile at 0x0000...0100, costing ~3,450 gas per verification. Deployed on Polygon PoS (March 2024), Optimism, Base, zkSync Era, and others. Makes passkey-based smart accounts economically viable on L2s.
EIP-7951
The mainnet Ethereum proposal for the same secp256r1 precompile that RIP-7212 deploys on L2s. Part of the post-Pectra Ethereum roadmap. Until it lands, mainnet passkey accounts fall back to expensive Solidity verification.
Coinbase Smart Wallet
A passkey-native ERC-4337 v0.6 wallet launched by Coinbase in June 2024. Uses passkeys as default ownership with iCloud Keychain / Google Password Manager sync, supports Sub Accounts (2025), and has been one of the largest drivers of mainstream AA adoption.
ZeroDev Kernel
A modular smart-account framework for ERC-4337 / ERC-7579 that separates a tiny core account from pluggable validator, executor, hook, and fallback modules. Used under the hood by many production wallets and embedded-wallet providers.
ERC-7579
The standard for modular smart-account interfaces, defining how validator, executor, hook, and fallback modules plug into a compliant account. Adopted by Kernel, Biconomy Modular Smart Account, Safe v1.5+, Etherspot, and other production designs.

Continue this lesson — 5 more sections in the CryptoBipto app.

Open lesson

Educational only — not financial advice.