What is account abstraction?

What is account abstraction?

Account abstractionAccount abstractionAccount abstraction lets a wallet be a programmable contract, with rules such as spending limits, instead of a single key.See it in the glossaryRead the explainer means a wallet is defined by code you can customise, not by one hard-wired rule. Today whoever holds the private keyPrivate keyA private key is the secret number that proves you control a wallet, and anyone who has it can spend your funds.See it in the glossary can move the funds, and the network checks nothing else. With abstraction the check becomes a program, so the wallet decides what counts as a valid action.

A normal wallet is an externally owned account (EOAEOAAn EOA, or externally owned account, is a regular wallet controlled by a private key rather than by contract code.See it in the glossaryRead the explainer): one key and fixed rules, so a lost key means lost funds. It is simple and works with everything. A smart accountSmart accountA smart account is a wallet run by a contract, so it can offer features like recovery, batching and spending rules.See it in the glossaryRead the explainer is a contract, a program stored at an address on the blockchain, that acts as your wallet. Its rules can be anything its authors write.

Picture a safe with one key. A smart account is the same safe with a rulebook taped inside: who else may open it, how much can leave per day, and what happens if the key goes missing.

The rulebook can contain:

• Spending limits. A daily cap or an approved list of recipients, so one mistake cannot empty the wallet.
• Recovery. Trusted people or devices can restore access. A multisig wallet is an early example, where several keys must agree.
• Batching. One confirmation approves several steps, so approving a token and swapping it takes one tap instead of two.
• Sponsored gas. GasGasGas measures the computing work a transaction needs, and you pay for it in small amounts of ETH.See it in the glossaryRead the explainer is the fee for every action. A smart account can let an app, or a token you hold, pay it.
• Passkeys. Fingerprint or face login can replace the twelve-word phrase.

How does ERC-4337 work?

ERC-4337 gives you a smart account without changing the Ethereum protocol. It needs no network upgrade, so it works on any chain where the EntryPoint is deployed. The network still only understands ordinary transactions, so ERC-4337 builds a second lane next to it:

1. You sign a request that describes what you want, called a UserOperation.
2. A bundlerBundlerA bundler collects requests from smart accounts and submits them to Ethereum as ordinary transactions.See it in the glossaryRead the explainer, a service that collects these requests, packs several into one ordinary transaction.
3. That transaction calls the EntryPoint, a single shared contract that every smart account uses.
4. The EntryPoint checks the request against your account’s own rules, then asks your account to carry it out.
5. If an app offered to pay your fee, a paymasterPaymasterA paymaster is a contract that pays the gas fee on behalf of a smart account user, sometimes in exchange for another token.See it in the glossaryRead the explainer contract covers the gas. The EntryPoint keeps a prepaid gas deposit for each account and paymaster.

The result is a wallet with custom rules and no protocol change. The cost is a new address, because a smart account is a new contract. Moving from an old wallet means moving funds and updating every place that knows your address.

What is EIP-7702?

EIP-7702 lets an existing wallet address use smart-account code without changing its address. It is part of the Pectra network upgrade, which activated on Ethereum mainnet on 7 May 2025. Its status in the standards repository is Final.

You sign a message, called a delegation, saying “let my address use the code stored at this contract address”. A transaction carries that message to the network. The network stores a marker on your account: the bytes 0xef0100 followed by the 20-byte address of the code. From then on, your address behaves like a smart account running that code, while the key still belongs to you.

Your address, your history and every place that knows it stay the same, so you get batching and sponsored gas without migrating. Delegating to the zero address clears the marker and returns the account to a plain wallet.

What is the risk of EIP-7702?

The main risk is that a delegation to bad code can take everything in the account. The EIP’s security notes state that a poorly implemented delegate can let a malicious actor take near complete control over a signer’s account.

Once your address runs someone else’s code, that code decides who can move your funds. If a site asks for a delegation and the wallet shows only a vague prompt, you may hand over control unknowingly. The post what am I signing explains how to read such prompts.

A few habits cover most of the risk:

• Only sign delegations from a wallet you trust, and only to code that wallet names and explains.
• Treat a delegation request like a request to hand over your keys, because in effect it is.
• Do not delegate an account that holds long-term savings until you understand what the code does.
• Delegation does not retire your old key. Whoever holds it can still move everything.

ERC-4337 vs EIP-7702

The two routes solve the same problem differently, and they can be combined. ERC-4337 gives a new address a full smart account with its own bundler lane. EIP-7702 upgrades the address you already have.

	ERC-4337	EIP-7702
What it creates	A new smart account contract at a new address	Your existing address, running delegated code
Protocol change	None	Yes, part of the Pectra upgrade
Your address	New	Unchanged
Key control	The account’s own rules decide	Your original key keeps full control, alongside the delegated code
Gas help	Paymasters, through the EntryPoint	Possible, through the delegated code and a sponsor
Main risk	Bugs in the account or paymaster	Delegating to malicious code

The EIP-7702 text describes an account delegated to ERC-4337 wallet code. The EntryPoint does not care whether the sender started as a contract or as a wallet with a delegation.

See it on a real contract

The card reads the prepaid deposit that a public USDC gas paymaster on Base (0x6C973eBe80dCD8660841D4356bf15c32460271C9, listed in Circle’s Paymaster docs) holds in the EntryPoint v0.7. The EntryPoint lives at 0x0000000071727De22E5E9d8BAf0edAc6f37da032. Inspect the EntryPoint in the Contract Inspector; on Base on 2026-11-11 it listed seven read methods and an empty proxy chain.

Prepaid gas deposit of a public USDC paymaster on Base

Reading live from Base

Inspect the EntryPoint in the Contract Inspector

Show the query

formatUnits(ep.balanceOf("0x6C973eBe80dCD8660841D4356bf15c32460271C9"), 18)

Common mix-ups

• “Account abstraction is a new blockchain.” It is not. It is a way for wallets on Ethereum to follow custom rules.

• “EIP-7702 replaces ERC-4337.” It does not. The two solve the same problem differently, and they can be combined.

• “A smart account means no more keys.” Not quite. Something still signs, whether a key or a passkey, and recovery rules decide what happens if it is lost.

• “Delegating with EIP-7702 moves my funds to a new address.” It does not. Your address and balances stay, and only the code your address runs changes.

Summary

• Account abstraction turns a wallet from a single key into a smart account. Its rules are code, such as spending limits, recovery, batching and sponsored gas.
• ERC-4337 creates a new smart account at a new address, and EIP-7702 lets your existing address run smart-account code.
• A delegation to malicious code can drain an account, so sign delegations only from a wallet you trust that explains the code.

For developers

You can read any account’s EntryPoint deposit with one evmquery request. The walkthrough, including the nonce trap where key zero can read zero for an active account, is in ERC-4337 EntryPoint API: read a smart account’s nonce and deposit.