#DappCon22 : Day 2 - Why Are Smart Wallets The Future Of Ethereum, Ivo Georgiev

Transcript

it's yeah okay uh hey everyone uh I'm Evo from umpire and umpire is to put it simply the competitor to metamask with a focus on ux so what we're doing is basically improving of the ux that we currently have in the ethereum and evm world uh and now the the presentation is titled preparing for the next billion users of web3 might sound exaggerated but it's what actually what we believe in and let me explain why so we all know the issues the ux issues of the ethereum ecosystem um but let's start let's start with the most obvious one uh and this is the fact that it's really complicated to create a

wallet so um especially in the regular flow uh where you have to install the browser extension and then write down a seed phrase and then confirm that you actually that you've actually written down this C trace and for us it's kind of native like we're very used to it and we're very used to doing it all over again uh but for a person who is used to signing up on Tick Tock for 20 seconds um or whatever Instagram for like two minutes um it's just completely unacceptable and I've seen many people many of my friends who Wanna kind of like crypto curious and they want to go into crypto but they use usually stock uh stick with centralized exchanges like binance and that's unfortunate and that's simply because they're like I'm not lazy but

they're in their own right not to like not to have the attention span to set up a real non-custo your wallet and it's not really I and and to say that it requires five times five times more time than creating an account on a web 2 up is not even the case it's like 10 times more uh more time uh then the other thing is it's impossible really hard um or just um it's impossible to recover your account uh and it's really easy to lose it especially for people who are not technical who don't have the Crypt the like the degenerate mindset and the like crypto native crypto Anarchist mindset uh people don't realize that the seed phrase is actually their money uh

they think that it's just some sort of recovery thing and they don't realize that anyone who just snaps a picture of this uh can have full access to their account immediately and it's just not foolproof and it's just not a ux paradigm that we should be doing in 2022 and then the other thing is that you need multiple does something that even for us as crypto natives it's a difficulty is the fact that we need multiple transactions to interact with defy even with uni swap even the simplest swap it requires an extra approval which for most people is super confusing like you broadcast the approval and you think that you've done your job and then suddenly you realize that you actually have to do another transaction and back in the days when gas fees were like 50 dollars people

were like okay great I'll pay ten dollars for the Swap and then they realize that they've only done the approval and now they have to pay another 50. um so yeah it's a super City ux and then of course you need ether to transact uh that's yet another road walk to the onboarding of a person uh into ethereum uh because imagine you've um you've done this compromise to install an extension to get familiarized uh with uh with that because most normal people don't actually use extensions like most of us who are like I.T professionals um do use browser extensions but most normal people don't um and then to familiarize yourself with the seed phrase to write down the sea Trace after all of that you suddenly discover that you cannot do anything

because you don't have either let's say that your friend sent you like two thousand dollars in usdt and then you can send them to someone and you find out that you have to actually sign up on binance anyway or use the built-in on-ramp of the wallet or whatever so yeah that's not the way to onboard the next one billion users it's completely impossible uh and let's go into the root reasons of why of where where those ux problems come from um so how wallets work today how eoa externally owned accounts work is you know you have one giant number which is impossible to guess uh the private key and this number is the whole authentication like if you know this number you have access to the account uh and this is difficult to manage and

practice because most of the modern web 2 apps they have authentication schemes with multi-factor authentication and Etc and that's really difficult to translate to the Paradigm of one giant one giant number so it's difficult to translate to the cryptographic uh to the cryptographic paradigm uh and uh of course you have other issues with EOS um other than the authentication with only one private key uh you also have to pay the gas fees in the native in the native token uh and I went into why this is a problem a bit earlier uh and you you can only run one operation at a time which is again a problem that leads again my example with the units of

approvals um and uh yeah to summarize it's tough to create an account uh you need to do multiple transactions uh you don't have it therefore gas and of course you have the security risks of losing your seed phrase misplacing your citrate someone taking a photo of it and you know how we've all seen like all the board Apes exports even though a lot of those were related to approvals um and a lot of those came from the fact that words don't parse and visualize what you're signing but nevertheless we know how easy it is to scam someone out of their crypto not even the people who are completely new but the people who are also kind of experienced uh and the the reason why those uh

social engineering exports work on experienced people is that we have this like you know you have these really good replicas of metamask which just pop up and ask you to recover the account and put in your seed phrase um so even if like even if we change this ux of the ux of the seed phrase We Are gaining a huge amount of security just by removing this Vector of people knowing that they have to input their seat rate somewhere uh so how do we solve this uh that's the big um that's the big question we solve this with smart wallets and smart wallets have been a thing for a while uh basically what what they do is each wallet uh each Wallet account is a separate contract and what this allows us to do is to actually use complicated not complicated but like sophisticated authentication

schemes uh so like instead of using one giant number so one private key which is everything we can use multiple private keys and we can set rules on how those multiple private Keys interact as a simple example you can have one of the private keys on your PC and one of the private keys on the mobile phone and then you have two a multi-factor authentication which is way more secure than Simply Having one private key on one device uh in that way it's really resistant to malware because you need to basically um the hacker needs to infect both of your devices in order to gain access to the account but then you can only you can use one of the private Keys as a

recovery key and have a Time locked recovery system so in case one of those private Keys is compromised you would see that that someone triggered the time lock transaction and you'll stop it with the other or with both of them that you have but in case you lose one of the private Keys we have questions later but in case you lose one of the one of the private Keys you can always use the other one to recover so it's kind of a win-win scenario and it's way more similar to the way webto authentication Works uh it's way more familiar to users and there's way less food guns because by doing this you can allow yourself to have less strict less strict recovery sorry less strict backup mechanisms and you would not make the user write down a

seed phrase so other benefits include like more sophisticated ways of account recovery Arjun for example another smart wallet has something they call social recovery where you delegate a bunch of people we're done buyer we're not fans of the of this because your friends could conspire against you if it's you know if it's about Millions there is that danger of course Arjun recommends that you delegate people who don't know each other which makes sense but who has like not everyone has such a diverse group of friends so yeah uh you can also have flexible fee payments what I mean is uh you can pay transaction fees in stable coins you can pay transaction fees in year c20s so

even if it's your first wallet and a friend of yours sends you like Shiba in whatever you can theoretically you can pay the fee in that token if we accept that that token as a fee token and you would not need any extra any extra tokens for the fee so it's really smooth onboarding experience uh you can batch transactions so you can do multiple things in one transaction meaning that the approvals would be essentially hidden and for some people that sounds like a security risk but it's not actually one because you you do the approval anyway uh and the approval would be shown in the transaction summary that it will get done it will just be rather than waiting for the approval to get mined and then doing the swap you will do everything at once and

you'll have um and once it's mined it's over so you don't have to do one thing and wait for it to mine and then do another thing uh and finally you you can do some automation like for example you can uh delegate let's say a chain link keeper or a gelato Network um automation that if uh if let's say um the price of some coin goes up you would automatically sell it uh and that's something that you just cannot do with your ways with your ways you always have to someone always has to hold the private key uh for a transaction to happen so if you were to do automations with your ways someone else would have to have custody of of the private key not the case with smart wallets with smart wallets you can just have it uh

call it on chain as a rule and then it would only get executed if certain rules are met um so yeah uh the benefits of smart wallets are plentiful um first of all um because of this sophisticated authentication mechanism or mechanisms uh we can Implement a way of signing up on and onboarding users without a seed phrase using something they're way more familiar with uh email and password and I know this sounds insecure but because of having two keys under the hood it's actually way more secure than any alternative there's a bunch of crypto companies doing email password authentication and claiming to be non-custodial but unfortunately they still keep a key on an HSM somewhere on

Amazon which is like it's not exactly non-custodial uh and the other benefit of smart wallets is that you can hand over authentication to a hardware wallet so you can start with an email and a password which is um obviously notice idea was a hardware wallet even though it's two keys and even though it's very secure it's still not as good as a stressor or ledger so you can start with that and then move control of the wallet to dresser once you get there like knowledge wise and you can do that without changing the address without moving funds without moving staking positions and Etc because obviously like if you're very like um deep into defy um you cannot just move all of your

positions easily many of them you can move but some of them you can't and with this you can change the underlying authentication keys without actually having to move funds which is really cool so let's even if you believe that let's say that your underlying key has been compromised even if you believe that your dresser has been compromised you can get a new one set it up again and move control to the new one without moving phones without changing address Etc and I already covered the sophisticated authentication mechanisms but you can do as I said you can do stuff which are way more familiar to users and are way more known from the web 2 world like to factor authentication and I already mentioned

that Arjun has account recovery you can also do multi-6 with smart wallets as is the case with gnosis safe and of course all of this while the wallet Still Remains non-custodial so um you're not relying on some sort of you're not running let's say on a centralized exchange that will implement this two-factor authentication you can actually enforce it on chain um so further benefits one click defy interactions there's no need for the approval step cover that already and one thing which is cool here is that you can avoid the infinite approval hack because why do we do the infinite approval hack today um we do it because we want to minimize the user the user effort so you want if I'm let's say transacting usdt swapping

usdt Twitter unit swap would automatically do not automatically but it will do an infinite approval so that when I'm doing it a second time I wouldn't have to go through this approval step and this is a security risk in particular options with uni swap it's not such a big such big of a problem because the contract is not upgradable but if it's a defy application where the contract is upgradeable and you give them an infinite approval they can upgrade the contract and basically review like years after without uh without even you knowing and without you even touching your Hardware wallet let's say or your normal wallet so you can get compromised in a like code way uh without without even knowing it and with smart wallets because the approval step can be batched

together with the swap you don't need to do the hack of the infinite approval in order to streamline ux um I hope that I hope that makes sense so um again you can have um you can pay gas fees and stable coins but the other cool thing is you can have automatic gas fee management which means that the relayer because smart wallets often work with every layer the alert can rebroadcast the transaction with a higher gas fee without you actually having to go through the signing step because the the actual authentication of the wallet and the authentication of the on-chain transaction are split are separate um and yeah I covered already

automations but uh let's look at the more exotic use cases of smart wallets because I think that's super exciting um you can actually have flash loans you can actually do a flash loan as a user and not as a bot uh and have it changed together with some actions to create an Arbitrage let's say I think some of you have experienced this with photo combo or maybe with insta dub uh but yeah that's a functionality of smart wallets and actually installed up and full combo are smart wallets uh they're just not Standalone smart wallets so another cool thing is that you can Implement custom cryptography that's kind of Impractical because obviously it costs gas and if you were to implement a new uh like elliptic curve algorithm on

in solidity or even in assembly uh it would cost like 2 million gas to verify for example the nist curve but there is potential there like if we get more pre-compiles in the evm uh one day we can have support for the niche curve which I know is controversial but it allows stuff like using the iOS secure Enclave to actually sign stuff so again that's a benefit because we have this we have this secure secure ways of signing messages and signing stuff uh built into iOS built into Android and we're not using them we're implementing everything in the uh in the user layer uh and again complete automation so you can do because you can do many stuff in one transaction and because you can do

automations you can liquidate your entire wallet um on some rule so let's say that you're kind of like um paper hands type type of person and you say if it drops under that amount then uh liquidate all of my crypto for usdt and it would just happen automatically and magically so some examples of smart wallets uh obviously I'm from Empire so I would recommend umpire but it's unlike all the other smart wallets it's not like Niche what they mean is that most of the smart wallets created today they have some very specific uh very specific Focus for example Arjun doesn't have a web version as far as I know uh diagnose is safe or

now the safe is optimized for multisig use cases even though I've seen recently people try to use it as their personal wallet um uh see we have of course sequence which is a relatively new one um and it's gaming focused but as I said umpire is focused is focused on specifically replacing metamask and being retail friendly uh rather than being niche uh and what are the adoption challenges that's um that's kind of a difficult topic because it's so unfortunate that some dubs do not are not even aware of the existence of smart wallets even though like billions are held in the safe and diagnosis safe to this day many dabs do not support smart wallet

signatures and actually many people asked us on the Boost how do smart wallet signatures work basically the answer is rather than doing an elliptic curve key recovery you just call the contract of the wallet to ask if the signature is valid and then the contract of the wallet would Implement some custom logic it would usually of course do easy recover at the end but because smart wallets can have more than one keys they do need to have some specific specific to the wallet logic and it's really easy to implement both in solidity so both on chain and of chain is really easy to implement a smart wallet signature verification um so yeah it's not that hard we just need more adapt developers to be aware that a contract can also be a wallet

then we have the second issue which is again related to this is that any some nft means just block smart smart contracts they think that every smart contract is a bot which is obviously very very wrong some smart contracts are actually users are actually smart wallets um and yeah um yeah and the last the last issue is that smart wallets used to have some gas overhead but I would rather say that this is resolved thanks to minimal proxies thanks to counter factual deployments thanks to this we can just do uh we are not gonna ask for the user to like pay a deployment fee on registration it's just that the first transaction that the user

does is going to be slightly more expensive uh when I say slightly it's like 40 000 gas of overhead which I know is not insignificant but it's only the first time it's only the first transaction after that the overhead is more like a thousand two thousand gas depends on how are you paying the transaction fee if you're paying it in a stable coin it could be more but we rolled out a really exciting feature called the gas tank which allows you to prepay for gas and this really optimizes uh optimizes stuff and reduces the overhead of smart wallets to almost zero uh to just the delegate co uh delegate core overhead which is Tiny so because we're running out on time I'm not gonna go into that but a lot of people ask if account obstruction is the

same as smart wallets it's not the same account obstruction is just a way of making smart wallets native so making them stand on the same ground as your ways and be um not indistinguishable but really not that different and like basically improving compatibility and Paving the way uh for smart wallets um so also there's um another cool deep dive topic which is comparing smart wallets to much party computation wallets uh because coinbase decided to roll out an NPC wallet and that's cool but MPC has certain disadvantages to Smart wallets obviously it has certain advantages as well the most significant one being that it also

supports Bitcoin and non-evm networks um but yeah that you can scan the QR code and check the Twitter thread uh it's really it's a really awesome breakdown of what the advantages and disadvantages of each each stack each Tech stack are um and a bit about um buyer I already told you um it's retail focused it's a retail Focus smart wallet and it's aimed at combining ux um and power so what we mean by power is that we want it to be usable for almost for almost anything uh and we believe that even people who are experienced in crypto still need easier tools because even even like programmers cannot read hex and

understand it immediately so you cannot have like a bunch of transaction summary and be expected to read hex and be expected that this would be secure in umpire with parse everything can we display it in a human friendly way um so yeah we we're not focused only on newbies we're also focused on power users um and one thing that we recently wrote out is the ability to use dubs within the Empire wallet Amber is currently web-based uh we're rolling out an extension soon but currently you can use it in the browser and connect dubs with wallet connect but this makes it even easier than wallet connect you can just open it up in Empire itself and it's really convenient and eliminates the

risk of you Googling something and ending up on a phishing website and another cool thing we have a game which is very similar to Cards Against Humanity but for crypto and we're going to be playing it today we're really excited to throw it out and you can check it out on our booth um and maybe we have time for my for one question that's right one question it is but uh first a round of applause for Eva can make it a good one make it a good one hello here uh yeah so I think you're a bit underestimating the cost of running a

contact smart wallet because just getting the owner into seeing this recovery is already 2500 gas and also you're forgetting about the part where if you want to get an erc77 you have to register your smart toilet in the ERC 1820 registry which is also a bit expensive so here is my question it's uh do you think 3074 is a big threat how do you because it wasn't one of your slide and you skipped it very fast so I'd like your opinion on ERC 1374 and will that replace smart toilets basically the OS and O score one yeah uh well how could it be a threat like it just makes uh it actually makes our lives much easier I mean it's it's not a threat for

us as users it's a threat for smartphone provider because it will make you irrelevant excuse me I think it's a threat to smartware provider as it might make you irrelevant might make us what irrelevant well no because it actually levels the playing field because the OA wallets can become uh can become automated in the same way that smart wallets can be but then again it it gives us an opportunity to be to also move to this hybrid model where we wouldn't have the issues with the signatures and the overhead so it actually allows us to keep our benefits it allows everyone to combine the benefits of EOS and smart wallets so yeah it kind of like levels the playing field but I don't think it's in a bad way because my time I think is like you

show that smart ride has unfortunately some downsides like it's 1271 is not accepted everywhere that kind of thing or main thing is not possible because people think smart contracts are attackers so I was thinking that eoas would just become as powerful without these downsides so is your point but nothing stops us from moving to that model but this model also has a flow because it still relies on that one private key which is the key to the whole account so still all the authentication stuff applies and I don't think 2000 gas is that much honestly because in most in most transactions in percentage terms it's like five percent or four percent and who cares about five percent in reality my user blamed me for a hundred cash

well yeah I know what you mean but in in practice it's worth it Evo thank you so much uh and we're ready for our next speaker I think thank you