“合规交易所的钱包实践探索 – 智能合约钱包的应用”
下载报告（中文） – PDF
Overview
In September 2023, Southeast Asia’s popular app Grab released a Web3 wallet. Through this Web3 wallet, users can perform transactions, earn rewards, use coupons, and more on the Polygon blockchain. This wallet was developed in collaboration with Circle and Grab, adopting the ERC4337 standard. It combines the high performance and low transaction fees of the Polygon blockchain to deliver a user experience akin to Web2 internet products.
This wallet primarily addresses two major issues that hinder Web3 users:
- Private Key Management: Users of the Grab Web3 wallet can create a wallet address and log in using their Grab account and a PIN, eliminating the need to manage private keys.
- Transaction Fees: Transactions are conducted using the ERC4337 standard, with a Paymaster mechanism paid for by addresses managed by Grab. This means users do not need to hold MATIC Token (Polygon blockchain native token) for gas fees required for network transactions.
“Currently, most retail users are not familiar with the use of digital wallets, and this unfamiliarity could increase the risk of exploits by malicious actors. To mitigate this, account abstraction, also known as smart contract wallets, can be used to improve the user experience and security of digital asset transactions. This technology allows for features such as account recovery, transaction limits, and freezing of lost accounts, without requiring users to understand the underlying technology.”
— Grab
The “2023 Global Digital Report” published by We Are Social reveals that over 51.6% of the world’s population are internet users. However, the largest wallet, Metamask, only surpassed 30 million users in 2022, indicating a significant gap in adoption. The complexity of wallets remains a major barrier for majority of users.
What is a smart contract wallet? What are its basic mechanisms?
Although the issue of user experience with wallets has been long discussed in the crypto community, due to Ethereum’s inherent design issues, the mainstream wallets used today, notably Metamask, are still EOA (Externally Owned Accounts) wallets. The high barrier of managing private keys and mnemonic phrases, as well as the need for native tokens to pay Gas as network fees, are major obstacles to widespread adoption by users.
In Ethereum’s original design concept, EOAs represent end users, while CAs (Contract Account) represent DApps (Decentralized Applications). Contract Accounts (CA) are used to execute relevant code logic to realize certain application scenarios. Externally Owned Accounts (EOA) are controlled by users through private keys, using ETH tokens as transaction fees to send transactions to the Ethereum network, to transfer funds or trigger Contract Accounts to execute certain functions. In Ethereum’s design, transactions can only be initiated by Externally Owned Accounts (EOA), and Contract Accounts (CA) cannot initiate transactions themselves. Externally Owned Accounts require users to manage private keys, which, before the application of technologies like MPC (Multi-party computation), posed a high technical barrier, requiring users to have knowledge in cryptography and network security.
Figure 1: Externally Owned Account (EOA) Usage Flowchart
Above is the user flowchart of externally owned account, user needs to manage a private key to hold the account/wallet and sign each transaction with the key to execute transactions on Ethereum blockchain platform. To sign the transaction and manage the private key requires user to have basic understanding of cyber security.
Smart contract wallets, as the name suggests, use contract accounts to simulate wallet accounts, addressing fundamental issues that hinder user adoption, such as private key management, account recovery, and paying transaction fees. They also enable richer use cases and possibilities through smart contract technology.
Figure 2: Functions of smart contract wallets
Account abstraction, a topic that is actively discussed in the Ethereum community, is a method for implementing smart contract wallets by allowing users to use smart contracts directly as their wallet accounts. This requires the Ethereum blockchain to support transactions initiated autonomously through smart contracts.
The Ethereum community has discussed various implementation methods, such as upgrading the logic of Externally Owned Accounts to support more functionalities or allowing Contract Accounts to initiate transactions. However, these upgrades would require modifications to the Ethereum blockchain itself, which is a lengthy process that would most likely require a hard fork.
The Ethereum community is also exploring solutions to achieve account abstraction without making significant changes to Ethereum itself. ERC4337 is one such solution, providing a decentralized way to support smart contract wallets without altering the Ethereum blockchain.
In ERC4337, users would send a new type of transaction called “UserOperation.” These transactions are sent to a specific transaction mempool for Ethereum validators and are aggregated for execution through an Entry Point Contract.
The ERC4337 solution requires only an upgrade to the validator clients to support this new type of transaction and the deployment of an Entry Point Contract. This contract was already deployed on the Ethereum mainnet on March 1, 2023. Other blockchains also adopt similar approaches to implement account abstraction and smart contract wallets. Additionally, networks like ZkSync natively support account abstraction to enable smart contract wallet functionalities.
What functionalities can smart contract wallets achieve?
Figure 3: Flowchart of smart contract wallet using paymaster function to execute transactions
Smart contract wallets can implement a wide array of functionalities. Some basic features include:
Multi-Signature Authorization: Smart contract wallets can facilitate shared authorization credentials across multiple trusted individuals or devices. For example, a smart contract wallet can be set up to be controlled by 5 trusted entities and require signatures from at least 3 of them to validate a transaction, thereby achieving a 3-out-of-5 multisig setup. A notable example of such a smart contract wallet is the Gnosis Safe wallet.
- Biometric Authentication: Smart contract wallets can leverage biometric data, such as fingerprint unlocking or facial recognition, to streamline wallet creation and wallet management, enabling users to adopt wallet technology without any blockchain knowledge.
- Account Recovery (Social Recovery): Users can designate trusted accounts, such as those belonging to family members, as recovery agents. These agents have the authority to grant access to new wallet instances and reset security permissions, thereby ensuring continued access to the wallet even in unforeseen circumstances.
- Transaction Limits and Account Freezing: Smart contract wallets enable users to set predefined limits on the amount that can be transferred out, such as daily, weekly, or monthly caps. This feature acts as a safeguard, preventing attackers from draining all assets in a single transaction if they gain unauthorized access. In such scenarios, the account limits provide crucial time for users to detect the breach and take necessary actions, such as freezing the account or modifying access controls, to secure their assets.
- Transaction Fee Delegation: One of the major barriers for users entering Web3 is transaction fees. Smart contract wallets can set up a fee delegation mechanism, introducing a third party (Paymaster) to pay transaction fees on behalf of the wallet users.
ERC 4337 Adoption Statistics
It has been nearly a year since the deployment of the ERC4337 endpoint contract. Currently, many applications have adopted it. From the data provided by Six Degree on Dune, we can observe the current usage of account abstraction technology (ERC4337) and its related application scenarios.
Figure 4: Smart contract wallet daily and monthly transactions
The daily transaction count of smart contract wallets has already reached a scale of one hundred thousand, with monthly transaction count exceeding one million.
Figure 5: Smart contract wallet DAU and MAU
The number of daily active wallets has exceeded 50,000, and the monthly active wallets surpass 500,000.
Figure 6: Smart contract wallet transactions distribution on blockchain
Applications adopting ERC4337 are mainly concentrated on Layer 2 networks or EVM-compatible sidechains, with Polygon, Arbitrum, and Optimism holding the dominant market share.
Figure 7: Smart contract wallet daily and monthly new users
In terms of new wallet numbers, there is a continuous deployment of new wallets, with the total number of wallets exceeding 2 million.
Adoption is concentrated among a few early startups, with Zero-Dev and Biconomy occupying the main market share. Big companies like OKX and Circle are almost invisible in the data.
Figure 8: Suppliers of smart contract wallets
From an application standpoint, the primary focus is on Telegram bots (such as trading robots), Worldcoin, and various other innovative products, predominantly in the realm of passive trading strategies.
Regarding Intent-centric applications, which are designed to enhance the Web3 user experience, their impact or representation appears to be minimal in the current data, suggesting a need for further development and integration in the context of ERC4337 applications.
Smart Contract Wallets Drawbacks
Smart contract wallets also have their own characteristics and drawbacks. The main ones are as follows:
- Non-EVM Compatibility: Smart contract wallets require additional customization for blockchains that are not EVM-compatible. If the underlying blockchain undergoes upgrades, it might affect the functionality and security of existing smart contract wallets.
- Contract Deployment for Wallet Creation: The creation of smart contract wallets requires contract deployment, which necessitates other developers to provide the necessary fees for wallet creation.
- Complexity and Higher Transaction Costs Compared to EOA Wallets: Since smart contract wallets operate through contracts, transactions are more complex, and each transaction typically consumes higher fees compared to EOA (Externally Owned Account) wallets.
- Scalability and Risk: Each new feature added to a smart contract wallet involves the deployment of a new contract and the authorization of this new contract. If the contract deployed for new features is attacked, it can affect the related wallets.
DigiFT’s Exploration and Application in Smart Contract Wallets
DigiFT, a capital markets services licence holder and recognized market operator regulated by Singapore’s MAS, aims to leverage blockchain technology to bridge Web3 with the traditional financial space, thereby enhancing the efficiency and transparency of asset issuance, trading, settlement, and custody while maintaining compliance and security. DigiFT’s recent introduction of a wallet solution based on the Safe smart contract and account abstraction significantly improves user experience and asset management security in several aspects:
Unified Account Model: DigiFT blurs the line between Externally Owned Accounts (EOA) and Contract Accounts through account abstraction technology. Users can create a smart contract account by simply registering an email address on the platform, avoiding the complexity and derived security issues of traditional private key management.
- Fee Delegation: Utilizing the Paymaster mechanism of ERC-4337 to be able to pay Gas fees for users’ on-chain activities on their behalf, effectively lowers the entry barrier.
- Social Recovery Feature: Users can recover their wallets in emergencies through trusted individuals, without the need for traditional mnemonic phrases or private keys.
- Blockchain Application Interoperability: Smart accounts created using the ERC-4337 standard can seamlessly interact with various blockchain applications.
- Advanced Security and Customization: The Safe smart contract wallet offers multiple security features like multi-signature transactions, emergency account management, transaction limits, and advanced authentication methods.
- Customization and Flexibility: Account abstraction and smart contract wallet technology provides more customization options and flexibility, paving the way for future smart contract-based customization to meet diverse asset management needs of users.
Account abstraction and smart contract wallet technology are among the means to safely and efficiently enhance the Web3 user experience. As a regulated exchange based in Singapore, DigiFT keeps pace with the development of the crypto industry, actively adopting wallet and trading technologies that represent the direction and advanced nature of the industry, thereby promoting the growth of the digital asset sector.
Disclaimer:
This article and its contents are prepared solely for informational purposes only and do not replace independent professional judgement. Under no circumstances should the information contained herein be used or considered as an offer to sell, or solicitation of an offer to buy any security. The content of this presentation is proprietary and no part of it may be reproduced or redistributed without the prior written consent of DigiFT Tech (Singapore) Pte. Ltd. (Rreferred to as “the Company”). This article contains public information as of the specified date and may be stale thereafter. No representation or warranty, express or implied, is made as to the fairness, accuracy or completeness of the article and the information contained herein and no reliance should be placed on it. None of the Company, its advisers, connected persons or any other person accepts any liability whatsoever for any loss howsoever arising, directly or indirectly, from this article or its contents. All information, opinions and estimates contained herein are given as of the date hereof and are subject to change without notice. This material should not be viewed as advice or recommendations with respect to asset allocation or any particular investment.
合规交易所的钱包实践探索 – 智能合约钱包的应用
概述
2023 年 9 月，东南亚国民应用 Grab 发布 Web3 钱包，通过 Web3 钱包，用户可以使用 Polygon 区块链转账、获取积分、使用优惠券等。该钱包由 Circle 和 Grab 合作实现，采用 ERC4337 标准，结合 Polygon 区块链高性能、低手续费的特性，从而实现接近互联网产品的用户体验，主要解决了 Web3 技术阻碍用户的两个重大问题：
- 私钥管理问题：Grab Web3 用户使用 Grab 账户 + Pin 密码即可创建钱包地址并登录，无需管理私钥;
- 手续费问题：发送交易采用 ERC4337 标准，通过 Paymaster 代付机制实现，由 Grab 管理的地址通过 Paymaster 代付机制支付手续费，用户自身不需要持有 Matic 代币作为区块链网络交易需要的 Gas 手续费。
在 Grab 的文档中提到：
目前，零售端用户并不熟悉如何使用加密钱包，这容易导致用户被恶意攻击。为了避免这类问题，账户抽象（Account Abstraction），也就是广泛熟知的智能合约钱包，能够提升用户数字资产交易的体验和安全性。这类技术能够实现账户恢复、交易限制、遗失账户冻结等功能，并让用户对底层技术无感。
根据 We Are Social发布了“2023年全球数字报告”，全球互联网用户超过 51.6%，而最大的钱包 Metamask 在 2022 年用户量才超过 3000 万，其中还有两个数量级的差距。钱包门槛还是对 Web2 用户的最大阻碍。
什么是智能合约钱包？基本原理是什么?
尽管钱包的用户体验问题在加密社区已经讨论良久，但由于以太坊自身的设计问题，目前主流用户使用的钱包仍然是以 Metamask 为代表的 EOA （External Owned Account，外部拥有账户）钱包，私钥和助记词管理的高门槛，以及需要代币支付 Gas 作为网络手续费是主要困扰用户大规模采纳的阻碍。
在以太坊的最初设计理念中，分别采用 EOA 代表用户、CA（Contract Account，合约账户）代表 Dapp，即应用。合约账户（CA）用于执行相关代码逻辑，实现一些应用场景，外部拥有账户（EOA）则由用户控制私钥，用 ETH 代币作为手续费，发送交易到以太坊网络，转账或触发合约账户来执行应用。在以太坊的设计中，交易只能由外部拥有账户（EOA）发起，合约账户（CA）不能自己发起交易。而外部拥有账户则必须由用户管理私钥，在 MPC（Multi-party computation，多方计算）等技术应用于钱包之前，用户管理私钥有较高的技术门槛，需要对密码学、网络安全等知识都有所涉猎。
图1：外部拥有账户使用流程图
每个外部拥有账户（EOA）都需要用户持有并管理私钥，在执行每一笔交易的时候使用该私钥进行签名并发送到以太坊区块链上执行。交易签名和私钥管理的部分需要用户对密码学知识有一定理解，同时会有诸多攻击方式来盗取用户钱包从而导致资产损失。
智能合约钱包，顾名思义，以合约账户来模拟钱包账户，解决一些阻碍用户使用的基础问题，如私钥管理，账户找回/恢复，支付手续费问题，并能够在合约中设计更丰富的使用场景。
图2：智能合约钱包能够实现的功能
以太坊社区密切讨论的账户抽象（Account abstraction）就是一种实现智能合约钱包的方式，让用户直接使用智能合约作为自己的钱包账户。这需要区块链能够支持通过智能合约直接发起的交易。
以太坊社区讨论过多种实现方式，如对外部拥有账户的逻辑进行升级，来支持更多的功能，或是直接允许合约账户来发送交易，但是这些升级都会需要对以太坊本身进行修改，需要漫长的时间并经过硬分叉实现。
以太坊社区也在探索在对以太坊本身不采取过多改动来实现账户抽象的方案，ERC4337 就是其中的一个，实现了一种去中心化的、无需改动以太坊来支持智能合约钱包的方式。
用户会发送一类新的交易，被称为“UserOperation”，这类交易会被发送到以太坊验证者的一个特定交易内存池，这类交易会统一在以太坊上的一个端点合约（Entry Point Contract）上执行。
ERC4337 的方案仅需要对验证者客户端进行一个升级增加对新类型交易的支持并部署一个端点合约即可。在 2023 年的 3 月 1 日端点合约就已经在以太坊主网被部署。其他区块链也有采用类似的方案实现账户抽象和智能合约钱包，或是如 ZkSync 这样的区块链网络直接原生支持账户抽象来实现智能合约钱包的功能。
智能合约钱包能够实现什么样的功能？
图3：智能合约钱包使用流程（Paymaster 代付机制实现）
智能合约钱包能够实现丰富多样的功能，一些基础功能包括：
- 多重签名授权:通过智能合约钱包实现跨多个受信任的人或设备共享授权凭证，如该智能合约钱包有 5 个受信任的设备，至少 3 个设备签名才能实现签名，实现 3/5 多重签名。目前主流的多重签名钱包 Gnosis Safe wallet 就是智能合约钱包的一种
- 生物识别：钱包利用生物识别创建和管理钱包，如指纹解锁、面部解锁等，用户无须任何区块链知识即可使用。
- 账户恢复（社交恢复）:设备丢失或忘记密码怎么办？通过智能合约钱包，用户可以设置一些预先批准的账户，如家人的账户等，这些账户可以授权新设备并重置访问权限。
- 设置交易限额和账户冻结:指定每天/每周/每月从账户转移多少价值的每日阈值。这意味着如果攻击者确实获得对用户账户的访问权限，他们无法一次性提取所有资产，而用户有机会冻结和重置访问权限。
- 手续费代付：阻碍用户进入 Web3 的另一大门槛就是手续费问题，通过智能合约钱包设置手续费代付机制，引入代理者（Paymaster）来为钱包用户支付手续费，而钱包用户本身不需要承担手续费。
理论上智能合约钱包能够实现更多丰富多样的功能，比如对于交易用户来说，智能合约钱包还能够实现限价挂单、网格交易、批量转账等。
ERC 4337 采用情况
自 2023 年 3 月 ERC4337 的端点合约部署以来，接近一年的时间，已经有诸多应用的采用。从 Six Degree 提供的 Dune 数据面板中我们可以观察到目前主要的账户抽象技术 ERC4337 和相关应用场景使用情况。
图4：智能合约钱包用户每日/每月交易笔数
从目前账户抽象和智能合约钱包每日交易次数已经达到了十万的规模，月交易次数超过百万。
图5：智能合约钱包日活/月活用户量
从钱包地址情况来看，日活钱包数超过 5 万，月活钱包数超过 50 万。
图6：智能合约钱包用户交易量区块链平台分布
相关应用主要集中在 Layer2 或者 EVM 兼容的侧链上，Polygon、Arbitrum、Optimism 占据了主要市场份额。
图7：智能合约钱包每日/每月新增用户
从钱包数新增的数据来看，有持续新钱包的部署，总钱包数超过 200 万。
从供应角度看，厂商比较集中在早期几个初创型企业，Zero-Dev 与 Biconomy 占据了主要市场份额，OKX、Circle 等大厂方案几乎看不到数据。
图8：智能合约钱包供应商占比
从应用角度来看，主要集中在 Telegram bot（交易机器人）、Worldcoin 等创新产品，大部分为被动式交易。
所谓的意图为中心（Intent-centric，更优化 Web3 用户体验的应用架构） 类型的应用在数据在没有明显提现。
智能合约钱包的缺陷
智能合约钱包也一样有自己的特点和缺陷。主要有如下几类：
- 非 EVM 兼容的区块链需要额外定制:若所在区块链进行升级，可能会影响到现有智能合约钱包的功能和安全性；
- 初始化成本：智能合约钱包的创建需要合约部署，需要有其他开发者提供手续费开销来创建钱包；
- 更高的 Gas 开销：相比于 EOA（外部拥有账户）钱包，智能合约钱包由合约运行，其交易有更高的复杂性，每笔交易消耗的手续费会更高；
- 可扩展性和风险：智能合约钱包每增加一个功能都是新合约的部署，并且会对新合约授权；若新功能所部署的合约受到攻击会影响相关钱包；
DigiFT 在智能合约钱包上的探索和应用
DigiFT 作为一家受新加坡金融管理局监管的金融资产交易平台，其目标是利用区块链的技术将 Web2 与 Web3 的金融世界进行连接，提高资产的发行、交易、结算、托管的效率与透明，同时兼顾合规性及安全性。DigiFT 近日推出的基于 Gnosis Safe 智能合约的账户抽象的加密钱包方案，将会在如下几个方面显著提高用户体验以及资产管理的安全性:
- 统一账户模型：DigiFT 平台通过账户抽象技术模糊了外部拥有账户 (EOA) 和合约账户之间的界限。使用平台的默认方式注册电子邮箱为用户创建智能合约账户，更简单的交互方式规避了传统私钥管理上的复杂性以及衍生的安全问题。
- 手续费代付：通过 ERC-4337 的 Paymaster 机制代付用户参与链上操作的 Gas 手续费，有效的降低了用户的进入⻔槛。
- 社交恢复功能：用户可以在紧急情况下通过信任的人员恢复他们的钱包，无需传统的助记词短语或私钥。
- 区块链应用的互操作性：使用 ERC-4337 标准创建的智能账户可以与各种区块链应用无缝交互。
- 先进的安全性和定制化：Gnosis Safe 智能合约钱包提供多重签名交易、紧急账户管理、交易限额和高级认证方法等安全功能。
- 定制化和灵活性：账户抽象技术提供了更多的定制化选项和灵活性，为将来基于智能合约定制化更多的功能以满足用户的多元化的资产管理需求。
账户抽象和智能合约钱包技术是安全、高效地提高 Web3 用户体验的技术之一，DigiFT 作为新加坡受监管的链上资产交易所，紧跟加密行业发展，积极采用代表业界发展方向与先进性质的钱包、交易等技术，推动数字资产领域的发展。
免责声明
本文及其内容仅供信息目的使用，不替代独立的专业判断。在任何情况下，本文所包含的信息不应被视为出售或购买任何证券的要约或征求。未经DigiFT Tech (Singapore) Pte. Ltd.（称为“公司”）事先书面同意，任何部分均不得复制或重新分发。本文包含的公开信息仅截至指定日期，并可能在此后过时。对于文中和其中所包含的信息的公正性、准确性或完整性，不作任何明示或暗示的陈述或保证，不应依赖于此。公司、其顾问、关联人员或任何其他人对于由于本文或其内容而直接或间接引起的任何损失概不承担任何责任。本文中所包含的所有信息、观点和估计均截至本日期，并且可能随时变动，恕不另行通知。本材料不应被视为关于资产配置或任何特定投资的建议或推荐。
