Service / Web3
Wallets that are easy and hard to drain.
Smart accounts, embedded and MPC wallets, passkeys, session keys and recovery, using ERC-4337 and EIP-7702 without opening the door to drainers.
[ 01 ]The short answer
What is Wallets and Account Abstraction?
Account abstraction turns a wallet from a single private key into a programmable account: passkey login, sponsored gas, batched transactions, spending limits, session keys and social recovery. ERC-4337 and EIP-7702 bring this to Ethereum and its L2s. The same power is a risk: one malicious EIP-7702 delegation signature can hand over every asset. We build wallets and smart accounts with clear signing, delegation allowlists, transaction simulation and scoped permissions, so convenience does not cost custody.
What you get
- Smart account contracts and modules
- Wallet SDK or app
- Bundler and paymaster setup
- Signing and simulation layer
- Security review
[ 02 ]What we build
The pieces, built to last.
- 01
Smart accounts
ERC-4337 and EIP-7702 accounts with modules for limits, recovery and automation.
- 02
Passkeys and social login
Sign in with a device passkey or email, with keys the user controls.
- 03
Session keys
Scoped, expiring permissions so games and agents act without a pop-up for every step.
- 04
Gas sponsorship
Paymasters so users pay in stablecoins or not at all.
- 05
Clear signing
Human-readable previews, simulation and delegation allowlists that block drainers.
- 06
Recovery
Guardians, time-delayed recovery and device rotation without seed phrases.
[ 03 ]Where it pays off
Where it earns its keep.
- 01
Consumer apps
Onboard users in seconds with no extension or seed phrase.
- 02
Agent wallets
Budgets and allowlists so an AI agent can spend, but only as permitted.
- 03
Treasury and teams
Role-based accounts with approval flows and limits.
- 04
Exchanges and fintechs
Embedded self-custody inside an existing app.
[ 04 ]How we deliver
Four steps, one team, start to finish.
The same people scope it, build it and stay after launch. Timings are typical for a first release; we agree yours after the deep dive.
- 01Week 1
Threat model and spec
Who can move money, under what conditions, and what happens when a key, an oracle or a bridge fails. Written down before code.
- 02Weeks 2 to 8
Build with invariants
Contracts or programs with unit, fuzz and invariant tests, least-privilege roles, timelocks and rate limits from the first commit.
- 03Weeks 6 to 10
Review and testnet
Internal review, an independent audit where value is at stake, and a public testnet with monitoring wired in.
- 04Ongoing
Mainnet and watch
A staged launch with caps, live alerting on admin actions and outflows, and a rehearsed incident plan.
[ 05 ]Stack
Tools we reach for.
Chosen per project, and we work in yours. Nothing here is a lock-in: you own the code and the accounts.
- ERC-4337
- EIP-7702
- ERC-7579
- ERC-7715
- Safe
- Kernel
- Pimlico
- Alchemy Account Kit
- Privy
- Turnkey
- WebAuthn
[ 06 ]Related work
Built by the same team.
[ 07 ]Further reading
Problems we found, and how we would solve them.
- Wallet security3 min read
One signature, every asset: the EIP-7702 delegation trap
ProblemA single EIP-7702 authorization routes every future call from an account to delegate code; phishing sites disguise it, and early analysis found most mainnet delegations pointed at copy-pasted sweeper contracts.ProposalTreat delegation as the most dangerous signature a wallet asks for: allowlist audited delegate contracts, show the target in plain language, simulate effects, scope permissions with session keys, and make revocation one tap.Read the proposal - Agent payments4 min read
Agent payments settle on promises. They should settle on proof
Problemx402 and payment channels let agents pay for APIs and compute, but settlement is blind to whether the inference ran, on which model, or how many tokens it really used.ProposalSettle only against two signatures: the agent's spending voucher and a usage receipt signed inside the provider's attested enclave, with payments stopping the moment attestation lapses.Read the proposal
[ 08 ]FAQ
Questions buyers ask.
It is safe when wallets show exactly what a delegation does and only allow audited targets. Most early mainnet delegations pointed to sweeper contracts used by drainers. Our article on the delegation trap explains the defences.
It depends on who must be able to recover funds and on your regulatory position. We compare them for your case before building.
Solana has different primitives: fee payers, multisig programs and embedded wallets. We build the equivalent experience there.
[ 09 ]More Web3 services
- Smart Contract DevelopmentContracts that do exactly what they promise.
- Solana Program DevelopmentSub-second apps on the fastest major chain.
- dApp DevelopmentOnchain apps people actually enjoy using.
- DeFi Protocol DevelopmentFinancial protocols that survive real markets.
- Smart Contract Security AuditFind the flaw before an attacker does.
- Real-World Asset TokenizationAssets that settle in minutes, not days.
- Stablecoin and Crypto PaymentsGlobal payments that settle in seconds.
- Layer 2, Rollup and Appchain DevelopmentYour own chain, when you really need one.
- Cross-Chain and InteroperabilityOne product across every chain your users use.
- Zero-Knowledge Proof DevelopmentProve it without revealing it.
- Onchain AI Agents and Agent PaymentsAgents that can earn, pay and be trusted.
One company at a time