Account Abstraction, Analysed: Abstract & Introduction

Table of Links

• Abstract & Introduction
• Ethereum Accounts
• Account Abstraction
• Security Analysis
• Further Discussions
• Conclusion & References

Abstract

Ethereum recently unveiled its upcoming roadmap’s Splurge phase, highlighting the integration of EIP-4337 as a foundational standard for account abstraction (AA). AA aims to enhance user accessibility and facilitate the expansion of functionalities. Anticipatedly, the deployment of AA is poised to attract a broad spectrum of new users and ignite further innovation in DApps. In this paper, we elucidate the underlying operating mechanisms of this new concept, as well as provide a review of concurrent advancements in accounts, wallets, and standards related to its development. We step further by conducting a preliminary security evaluation to qualitatively assess the extent of security enhancements achieved through AA updates.

Index Terms—Ethereum, Account Abstraction, EOA

I. INTRODUCTION

Accounts within the Ethereum ecosystem [1] serve as the bedrock for asset querying, storage, and transactions, constituting a pivotal element of its infrastructure. However, the present account design poses challenges for Web2 users due to its complicated design. Ethereum classifies accounts into two types [2], namely, externally owned accounts (EOA) and contract accounts (CA)[1]. EOA is controlled by private keys held by its creators or users. Contract accounts are controlled by codes without the involvement of private keys (Fig.1). The reliance on private keys makes these two accounts act in different roles: EOA can prove the validity of a transaction and trigger the state transition in CAs but with limitations:

• Expense: The functioning of the contract wallet necessitates initiation by an EOA, essentially entailing a contract invocation. Every transaction within this process incurs an extra 21,000 Gas cost, which includes charges for ECDSA signature verification, Nonce value verification, and ensuring adequate account balance.

• Elevated barrier: EOAs must possess a substantial ether balance to cover Gas expenses (involving management of two separate accounts), or alternatively depend on a Relayer to manage Gas payments, potentially introducing centralization concerns.

• Flunction: In addition to the fee in ether (ETH), users are consequently required to hold ether, which exposes them to the potential volatility of its price.

• User perception: From a user’s perspective, grasping the nuances of gas price, gas limit, and transaction congestion is far from straightforward.

The effort to integrate two distinct types of accounts while preserving their core functionalities has been a longstanding subject of deliberation within Ethereum communities. Two primary technical pathways have come to the forefront.

• EOA delegates control to smart contracts, in which the contract logic can inplement the core functionalities from EOA transactions such as gas payment (e.g., EIP[2] -3074).

• EOA accounts are designed to be armed with several key functionalities from smart contracts (EIP-4337).

The concept of account abstraction (AA), indexed by EIP4337 [3], aligns with the second approach, aiming to bestow EOA with the programmable functionality akin to CAs. The incorporation of EIP-4337 into the present roadmap [4] signifies Ethereum’s definitive stance in these dual directions. By adopting AA updates, Ethereum sidesteps the potential hurdle of transitioning existing users. This is attributed to its implementation on the application layers rather than the consensus layer, which inherently offers robust backward compatibility capabilities. Ethereum transactions are required to emanate from EOAs, which are typically accessed through various wallets like MetaMask, Phantom, and Rainbow. The account abstraction approach ensures the retention of current users while empowering them with an effortless means of engaging with smart contracts. Beyond that, the functionalities elucidated in EIP-4337 can be further applied across Ethereum-compatible blockchains, including platforms such as BNB Chain (formerly BSC), Polygon, Avalanche, Optimism, Arbitrum, and Base (also refer to Sec.III-D).

As of August 2023, a sequence of indicators[3] highlights the escalating attention garnered by this impactful concept. The cumulative count of active accounts has reached 739,295, and the aggregate count of successfully executed UserOperations (detailed explanations refer to Sec.III) has reached 1,307,197. In addition, the total number of bundled transactions has amounted to 1,197,871. Besides, in August, a remarkable upswing is observed across various market indicators compared to previous months (starting from March 2023, which marks the launch of EIP-4337): The count of monthly active EIP4337 smart accounts has surged to an impressive 420k (inclusive of all platforms). The earnings from monthly revenues and UserOperation fees have surpassed 24k and 220k respectively. Notably, the monthly tally of successfully executed UserOperations stands at 710k, while the gas expenses covered by paymasters have exceeded $360k USD

Our attempts. Given its nascent stage, only a limited number of studies have delved into this emerging concept. We are aligned with the growing momentum surrounding account abstraction and further expand the boundaries of its research landscape. In particular,

• Concept refinement (Sec.II&III). We conduct a thorough exploration of diverse resources, including academic literature, blogs, forum discussions, and Git repositories. Drawing from such analyses, we offer a coherent and succinct elucidation of the fundamental concepts and operational mechanisms of account abstraction.

• Security framework (Sec.IV). We further delve into the security risks that may exist in AA. Delving into historical contract and account-related vulnerabilities, we construct a framework (Tab.III) to engage in a proper discussion about the security implications of this account paradigm.

• Further discussion (Sec.V). Additionally, we provide more discussion about the principle of account abstraction designs and potential opportunities inspired.

Security results. Our security discussion (majorly Sec.IV) led to the following insights. It is evident that integrating AA into current account systems can alleviate a multitude of vulnerabilities in both contract usage and block creation domains. However, AA’s effectiveness remains limited when addressing intrinsic aspects of solidity language and design intricacies, such as structural elements, configuration constraints, and verification mechanisms. Upon further analysis, we have identified that AA’s strength in fortifying security arises from its decoupling of key account abstraction components. By reallocating functions previously encompassed within accounts, AA can protect against numerous vulnerabilities in Ethereum’s application layer: critical functions like gas payment mechanisms are seamlessly transferred to the paymaster, avoiding vulnerabilities related to gas fees; the intricate process of transaction packaging now benefits from the management of bundler; and complex trading and swapping operations, previously reliant on CEX or DEX, are elegantly executed within the same transaction. The decoupling process has reduced the threat that was heavily dependent on contract functions. thereby increasing the overall security quotient.

Available resources. The Ethereum official documentation [4] has introduced formal documentation detailing its account abstraction concept and roadmap that is accompanied by a suite of relevant standards, encompassing EIP-2771, 4337, 2938, and 3047. Notably, EIP-4337 encapsulates the central concept driving this transition. In a study by Singh et al. [6], an initial exploration into the Ethereum account abstraction is provided, outlining its distinctive features and functional methodologies. Binance Research [7] has released an insightful analysis that delves into recent market trends and noteworthy advancements within this area. Based on these contributions, a range of media sources [8]–[11] have embarked on elucidating this intricate concept, offering surrounding insights and explanations. Besides, several studies have initiated the development of on-top solutions aimed at addressing various challenges within the Web3 ecosystem [12], such as address incompatibility [13].

[1] Across several documents, the term smart contract account has been used interchangeably to denote the same concept within the context of this paper.

[2] Ethereum Request for Comment (ERC) is one type of Ethereum Improvement Proposals (EIP) that requires on-chain agreements. Throughout this paper, we use EIP to refer to all standards for the sake of simplicity.

[3] Dune Analytics https://dune.com/niftytable