{"id":"ERC-4337","slug":"account-abstraction","name":"Account Abstraction Using Alt Mempool","status":"Last Call","chain":"both","category":{"id":"transaction-friction","name":"Transaction Friction","description":"Reducing clicks, signatures, and mental overhead"},"journeyStages":[{"id":"executing","name":"Executing Transactions","description":"Performing on-chain actions"},{"id":"gas","name":"Gas & Fees","description":"Paying for transactions"}],"uxImpact":"Users interact with smart accounts instead of EOAs. No seed phrases required, social recovery possible, gas payable in any token. Design implications: design onboarding without 'write down 12 words', show gas payment token selector, build recovery flows (guardian management UI), display bundled operations as single actions. Design decisions: tradeoff between custodial simplicity and self-custody complexity, must handle paymaster failures gracefully, decide whether to abstract UserOperations completely or expose for power users. 54M+ smart accounts, 1B+ UserOps. Smart wallets retain 70% of users vs 60% for seed-phrase wallets . Primary solution to Gas Hurdle (Critical), Key Management Burden (High), and Forced Backup Friction (Medium). Widely deployed (Safe, Biconomy, ZeroDev).","hasDetailedContent":true,"content":{"id":"ERC-4337","summary":"ERC-4337 is the infrastructure that makes \"Account Abstraction\" work. It creates a parallel system where smart contract wallets can exist with full programmability: custom validation (passkeys, multisig), gas sponsorship via paymasters, bundled operations, and account recovery. It's the backend that powers the best wallet UX patterns.","designerTakeaways":["Checkouts can let users pay gas in USDC or have it sponsored, so \"buy ETH first\" disappears from the flow.","Account recovery can look like a password reset: guardians, an M-of-N threshold, and a cancel-able timer.","Multi-step flows (approve, swap, stake) can collapse into a single atomic confirmation instead of stacked modals."],"applicability":{"whenToUse":["New users need to act before they own ETH for gas.","The product benefits from one confirmation for approve, swap, mint, stake, or claim flows.","The account needs recovery, spending limits, passkeys, guardians, or multisig rules.","The team can support smart account infrastructure and clear fallback states."],"whenToAvoid":["The product cannot support bundler and paymaster failure paths.","The user must keep using a plain EOA with no smart account layer.","The flow is a single low-risk transaction where sponsorship, batching, or recovery adds no user value.","The team cannot explain who controls recovery or who pays fees."]},"prototypeFirst":[{"screen":"Fee selection","why":"This is where ERC-4337 removes the \"buy ETH first\" dead end, but only if the fee model is clear.","covers":["Gas sponsorship","Pay gas with another token","Paymaster unavailable"],"include":["Sponsored label with value","Fee token options","Fallback to user-paid gas"]},{"screen":"Bundled confirmation","why":"One signature can contain multiple consequences. The user still needs to understand the full action.","covers":["Approve plus action","Atomic execution","Simulation failure"],"include":["Ordered step preview","All-or-nothing copy","Blocked signing when simulation fails"]},{"screen":"Recovery setup","why":"Recovery replaces the seed phrase backup moment, so it needs to feel like account safety, not advanced settings.","covers":["Guardian invites","M-of-N threshold","Recovery inactive state"],"include":["Guardian status rows","Threshold copy","Clear \"not protected yet\" state"]},{"screen":"Recovery in progress","why":"A recovery flow is both help and risk. The owner must see what is happening and how to stop it.","covers":["Guardian approvals","Security delay","Cancel recovery"],"include":["Countdown","Approving guardians","New owner destination","Prominent cancel action"]},{"screen":"Operation status","why":"ERC-4337 adds steps between signing and confirmation. Status copy should make progress feel legible.","covers":["Signed","Bundler pending","Included","Confirmed"],"include":["Single status strip","Plain-language states","Expandable user operation hash"]}],"mentalModel":[{"label":"User intent","description":"The product still asks the user to send, swap, mint, or recover. \"UserOperation\" is only the package the app builds behind the interface."},{"label":"Smart account","description":"The account is contract code, so validation can be passkeys, guardians, multisig, session keys, or another rule the wallet supports."},{"label":"Bundler","description":"A bundler collects valid operations and submits them on-chain. Your status UI should track submission, inclusion, and confirmation as one journey."},{"label":"EntryPoint","description":"The EntryPoint checks account and paymaster rules before execution. Failed simulation belongs in the product UI before the user signs."},{"label":"Paymaster","description":"A paymaster can sponsor gas or charge another token. Designers need a clear fallback when sponsorship is unavailable."}],"statesToDesign":[{"state":"Account not deployed","trigger":"The user is using a counterfactual smart account for the first time.","userNeed":"Know whether setup is automatic, costs money, or changes timing.","designResponse":"Keep it in setup or transaction details unless deployment affects cost, time, or risk."},{"state":"Paymaster quote unavailable","trigger":"The sponsor cannot quote gas or the selected fee token is unsupported.","userNeed":"A path forward that does not feel like a broken checkout.","designResponse":"Offer another fee token, user-paid gas, or a retry with plain-language reason copy."},{"state":"Simulation failed","trigger":"The operation would fail during validation or execution.","userNeed":"Understand what to fix before signing.","designResponse":"Block signing, name the failed step, and give a concrete action such as reduce amount or remove step."},{"state":"Bundler pending","trigger":"The user signed, but the operation is waiting for inclusion.","userNeed":"Confidence that the action left their device and is still progressing.","designResponse":"Show sent, processing, included, and confirmed as one status strip with an expandable technical ID."},{"state":"Guardian invite pending","trigger":"A recovery contact has not accepted or confirmed.","userNeed":"Know whether the account is protected yet.","designResponse":"Show inactive recovery until the threshold can be reached, not just a generic pending badge."},{"state":"Security delay active","trigger":"Recovery has enough guardian approvals and is waiting out the delay.","userNeed":"Know when recovery completes and how to stop it if it is suspicious.","designResponse":"Show countdown, approving guardians, destination account, and a prominent cancel action."}],"designDecisions":[{"question":"Who pays gas in this flow?","recommendation":"Show one fee model at a time: sponsored, paid in native token, or paid in another token.","rationale":"Users need to know whether the app is covering the cost, whether their token balance will change, and what happens when sponsorship ends."},{"question":"How does the user recover the account?","recommendation":"Design guardian setup, threshold progress, a security delay, and a cancel path as first-class states.","rationale":"Recovery is not a settings footnote. It is the replacement for \"save these 12 words\", so the user must understand it before they need it."},{"question":"How much protocol detail appears in the confirmation?","recommendation":"Summarize the human action first, then expose technical details behind review or advanced disclosure.","rationale":"The protocol has many actors, but the user is approving an outcome. Showing plumbing first creates doubt instead of informed consent."},{"question":"What happens if the operation cannot be included?","recommendation":"Preflight with simulation, then give a specific recovery action: change fee token, remove a step, retry later, or pay gas yourself.","rationale":"ERC-4337 adds new failure points. Generic \"transaction failed\" copy hides the fix and makes the smart account feel unreliable."},{"question":"Does the account need to be deployed now?","recommendation":"Treat deployment as setup work unless the cost or timing changes the user decision.","rationale":"Counterfactual accounts let users begin before deployment, but first execution may still create the account and affect gas or status timing."}],"problemsSolved":[{"problem":"Users must hold ETH to do anything on-chain","oldWay":"Buy ETH → transfer → wait → then interact","newWay":"Paymaster sponsors gas, user pays in USDC or nothing at all","impact":"critical"},{"problem":"Losing seed phrase = losing everything","oldWay":"12 words is only backup, lose it and funds are gone forever","newWay":"Social recovery, guardian signatures, account restoration possible","impact":"critical"},{"problem":"Only ECDSA signatures work for authentication","oldWay":"Must sign with private key derived from seed phrase","newWay":"Custom validation: passkeys, multisig, MPC, anything","impact":"high"},{"problem":"Each operation requires separate transaction","oldWay":"Approve, wait, swap, wait, stake, wait...","newWay":"UserOps bundle multiple calls, execute atomically","impact":"high"},{"problem":"Smart wallets couldn't initiate transactions","oldWay":"Needed an EOA to trigger contract wallet actions","newWay":"Bundlers submit UserOps, wallets work independently","impact":"high"}],"uxPatterns":[{"name":"Gas Abstraction","description":"User sees final cost in their preferred token or zero","mockup":"gas-abstraction","components":["Gas token picker","Estimated cost","Order total"],"userFlow":["User initiates purchase","App fetches gas quotes from paymaster","User selects payment token","UserOp created with paymaster data","User signs once","Paymaster handles conversion"]},{"name":"Social Recovery Setup","description":"Configure guardians who can help recover account","mockup":"social-recovery-setup","components":["Guardian list","Guardian status row","Threshold control","Time-lock notice"],"userFlow":["User opens recovery settings","Adds guardian addresses or emails","Sets threshold (2 of 3)","Guardians confirm participation","Recovery becomes active"]},{"name":"Account Recovery Flow","description":"Guardian-assisted account restoration","mockup":"account-recovery","components":["Approval progress","Time-lock countdown","Recovery status"],"userFlow":["User initiates recovery from new device","Contacts guardians for approval","Guardians sign recovery request","Threshold reached","Time lock countdown begins","Recovery completes after delay"]},{"name":"Bundled DeFi Operations","description":"Complex multi-step DeFi in one interaction","mockup":"bundled-defi","components":["Step list","Savings summary","Execute-all button"],"userFlow":["User selects strategy/actions","App builds UserOp with all calls","Shows preview with savings","User signs once","All steps execute atomically"]}],"uiComponents":[{"name":"Gas token picker","description":"Choose which token to pay gas with, or use a sponsor","kind":"selector","states":["loading","ready","no sponsors","selected"],"props":["availableTokens[]","gasEstimates","selectedToken","onSelect"]},{"name":"Guardian list","description":"Add, remove, and see the status of recovery guardians","kind":"list","states":["empty","configuring","active","recovering"],"props":["guardians[]","threshold","onAdd","onRemove"]},{"name":"Transaction preview","description":"Show what a single bundled transaction will do, step by step","kind":"preview","states":["building","ready","simulating","error"],"props":["calls[]","gasEstimate","paymasterInfo"]},{"name":"Recovery progress","description":"Track guardian approvals, the time lock, and final completion","kind":"progress","states":["initiating","gathering approvals","time-locked","complete"],"props":["approvals","threshold","timelockRemaining"]},{"name":"Submission status","description":"Show submission, inclusion, and confirmation as one strip","kind":"status","states":["submitting","pending","included","confirmed","failed"],"props":["userOpHash","txHash","error"]}],"seenInTheWild":[{"app":"Coinbase Smart Wallet","url":"https://www.coinbase.com/wallet/smart-wallet","note":"Passkey signup, no seed phrase shown. App-level gas sponsorship for first-time interactions."},{"app":"Safe (Smart Account)","url":"https://safe.global/","note":"Original smart contract wallet. Multisig, modules, and 4337-compatible bundled transactions."},{"app":"Privy","url":"https://privy.io/","note":"Embedded wallets that sign in with email or social, then route transactions through a bundler so users never see ETH."},{"app":"Argent","url":"https://www.argent.xyz/","note":"Pioneered guardian-based social recovery and the cancel-able time lock UX patterns most wallets now copy."},{"app":"ZeroDev","url":"https://zerodev.app/","note":"SDK for building bundled multi-step actions (approve + swap + stake) behind a single signature."}],"antiPatterns":[{"pattern":"Exposing \"UserOperation\" terminology to users","why":"Technical jargon confuses users, they just want to \"send\" or \"swap\"","instead":"Use familiar terms: transaction, transfer, swap","severity":"high"},{"pattern":"No fallback when paymaster rejects","why":"User stuck if sponsor runs out or rejects","instead":"Graceful fallback to ETH with clear explanation","severity":"critical"},{"pattern":"Recovery with no time delay","why":"Compromised guardian could instantly steal account","instead":"Mandatory time lock (24-72h) to allow legitimate owner to cancel","severity":"critical"},{"pattern":"Single guardian recovery","why":"One compromised contact = lost account","instead":"Require M-of-N threshold (e.g., 2 of 3 guardians)","severity":"critical"},{"pattern":"Hiding gas costs in sponsored transactions","why":"Users shocked when sponsorship ends and they pay","instead":"Show \"Sponsored ($0.35 value)\" so users understand","severity":"medium"},{"pattern":"Not simulating UserOps before submission","why":"Failed UserOps waste user time and sometimes gas","instead":"Always simulate and show clear error if it would fail","severity":"high"}],"vocabulary":[{"use":"Transaction","avoid":"UserOperation, UserOp","why":"UserOp is internal protocol jargon. From the user's seat, they are sending a transaction. What happens under the hood is not their concern."},{"use":"Smart wallet, Smart account","avoid":"4337 wallet, ERC-4337 account","why":"Spec IDs do not belong in user UI. \"Smart wallet\" tells the user it can do more than a normal wallet without naming the protocol."},{"use":"Sponsored, Free for you","avoid":"Gasless, Free gas","why":"\"Gasless\" is ambiguous: does it mean truly free, or paid in another token? \"Sponsored\" is honest about someone else paying."},{"use":"Pay gas with USDC","avoid":"Use ERC-20 paymaster, Token paymaster","why":"Paymaster is the backend role. The user just sees which token they are paying with."},{"use":"Guardian","avoid":"Trustee, Recovery key, Co-signer","why":"Argent introduced \"guardian\" and the ecosystem standardized on it. Trustee sounds legal, co-signer sounds like a loan, recovery key sounds like a thing you can lose."},{"use":"Security delay","avoid":"Time lock, Timelock","why":"\"Time lock\" is engineer language. \"Security delay\" tells the user what the delay is for and why they should not be annoyed by it."},{"use":"Add a backup, Set up account recovery","avoid":"Configure social recovery, Set up your recovery module","why":"Backup is the mental model people bring from photos and passwords. \"Module\" is implementation language."},{"use":"Sent, Submitting","avoid":"Submitted to bundler, Included in mempool","why":"Bundler and mempool are plumbing. The user cares that the action left their device and is on its way."},{"use":"Cancel recovery","avoid":"Veto, Abort","why":"\"Veto\" sounds adversarial. \"Abort\" sounds like a system error. The owner pressing cancel on their own recovery is a normal, calm action."}],"onMonad":[{"aspect":"Bundler Economics","ethereum":"Bundlers need to account for MEV, price fluctuations","monad":"Fast finality reduces bundler risk, potentially lower fees","designImplication":"Gas sponsorship more economically viable on Monad"},{"aspect":"UserOp Confirmation","ethereum":"UserOp → mempool → block (12+ seconds)","monad":"Sub-second finality for bundled operations","designImplication":"Can show confirmation instantly, no long pending states"},{"aspect":"Reserve Balance","ethereum":"Smart wallet can be drained to zero","monad":"10 MON reserve required; delegated accounts cannot use emptying exception","designImplication":"Show \"spendable\" balance that accounts for reserve"},{"aspect":"Recovery Time Lock","ethereum":"48h delay feels long but necessary","monad":"Could potentially reduce with faster block times","designImplication":"May offer shorter recovery periods"}],"keyTakeaways":["ERC-4337 is the infrastructure, not the UX. Hide the complexity.","Gas abstraction: let users pay in any token or have sponsor","Social recovery needs threshold (M-of-N) AND time delay","Always simulate UserOps before asking user to sign","Never show \"UserOperation\" or \"bundler\" to users"],"technicalNotes":"ERC-4337 uses a singleton EntryPoint contract that verifies and executes UserOperations. Smart wallets implement IAccount interface with validateUserOp(). Paymasters implement IPaymaster to sponsor gas. Bundlers are off-chain relayers that submit UserOps to EntryPoint. The system is permissionless: anyone can run a bundler."},"sources":[{"label":"Official specification","url":"https://eips.ethereum.org/EIPS/eip-4337","type":"official-spec"},{"label":"Discussion","url":"https://ethereum-magicians.org/search?q=ERC-4337","type":"discussion"}],"urls":{"canonical":"https://www.eipsfordesigners.com/standards/ERC-4337","markdown":"https://www.eipsfordesigners.com/standards/ERC-4337/content.md","agent":"https://www.eipsfordesigners.com/standards/ERC-4337/agent.md","api":"https://www.eipsfordesigners.com/api/standards/ERC-4337","official":"https://eips.ethereum.org/EIPS/eip-4337","discussion":"https://ethereum-magicians.org/search?q=ERC-4337"},"freshness":{"lastReviewed":"2026-04-05","lastUpdated":"2026-04-05"}}