DappCon 2023: Bringing The Best Of Web2 UX And Security To Web3 - Thomas von Bomhard

Transcript

so yeah welcome everyone uh to my talk um bringing the best of web 2 uxix and security to web 3 and I mean why is this interesting I mean obviously there are billions of users in web to if we um take a few of the uxix concepts there and also security it's more familiar to them and then easier to unboard more users into the web 3 space okay let's start first of all actually with the users often or not often but sometimes forgotten so what do normal users want in web 3 and I mean they really I mean it's clear right they don't care about all the blockchain Technologies the chains all this things we're talking here

daytoday L1 L2 rollups all that stuff I mean they just want to use and access to Applications so maybe they want to play a game they have heard of or they want to just invest into crypto these are the typical things we could go deeper in this but just think of people who are not in crypto today and yeah they don't want the complexity we still have in web 3 so let's think of someone who have heard of it and wants to use his first step um what will happen if you would start his journey and well the first paino is actually the wallet right so you need a wallet if you click anywhere and then you have a big choice of

wallets let's say somehow you make a choice then you need to go through the wallet experience you need to I mean install and download the wallet then you need to back up a seat phrase never heard of a seat phrase all these things then you need to onramp e to pay fees so there are a lot of steps a user need to go through and yeah the wallet is actually quite front and center in the blockchain experience and we at Argent I mean we are a wallet but we think it's actually not ideal it should should be much more invisible and the application the dep should be much more prominent um yes so in addition to that um a user actually needs to learn a lot

often the hard way right like security relies on a user secret this seat phrase I mean most non-custodial wallets today whether Hardware or software still rely on the seat phrase and the user needs to take care of it but you might not really fully understand it so he might lose basically everything um another thing is users can't make mistakes I mean we we have support at arent for many years we see it still dayto day that things happen like oh you made a typo on the address funds lost oh you signed something on some fraud page there are tons of them you lost everything or whatever you have a virus on your

computer um which yeah led to bad transaction and in general also it's still very complex I mean you a user directly interacts with a defi um complicated Financial Primitives and every operation he needs to kind of Click through right like allow or approve LP rebalancing I mean it's quite quite heavy so there's still too much fraction that normal users can do what they want in web 3 okay um now what would the dream experience look like um so going through the things like ideally you should shouldn't be you you

should uh should not need to download or install anything um you should be able to create an account in seconds you um should not need to understand all these complex Concepts like seat phras transaction fees and that stuff um also you should have a simple way to recover an account I mean we two users are used to not losing everything um so there should be some way then there should be also some fraud detection because it's early there's still of a lot of scams so we need something to to help the users not to run into everything everything should be one click we believe and last also less approvals okay and then if you think about this list we end up actually

coinbase I mean one of the big centralized exchanges I mean they do quite a good job on that because it fulfills most of the things it's quite easy to on board you don't have all the fraud risks you have a recovery and so on so on but obviously I mean what we also strongly believe from the web three space and we have seen many examples why this is important I mean we still want to have self custody um this brings us to another example which is so rare maybe you know know it it's a game quite popular for trading soccer cards and they built also quite a cool experience that users from rep 2 can easily log in

with email password or social login and so on but you still get a wallet kind of behind the scenes um like more invisible but it is self custodial so they built this for them for themselves and it's working quite well but we think one thing is missing there um it would be much better to Port the account actually to multiple depths because this just for so rare right you cannot use this kind of account on other deps okay so that's what we would like to have um there's one um problem or if you look at this list the kind of attenion you want to have all these cool web no these features but they also want to have self cust custody and that's a

challenge to to achieve but the solution or the secret to that is as the discussed a few times account abstraction and we will go into why this enables a new experience so what is account abstraction very brief so an account has four main functionalities which you want to have you want to have you want to be able to authorize transactions execute transactions somehow need to pay the minor and you need to protect against uh replay attacks and yeah all of this on ethereum and other evm chains is hardcoded so you cannot change it um and

the cool thing with account abstraction is now that you can reprogram these things which opens a huge space for you can use different signature schemes cipic curves multiple signers and we will go through examples um we and Argent Focus mostly on stocket um because or one of the main reasons is they have native support of account abstraction and also to be clear here it really means there is no eoa anymore right it just doesn't exist on stocket everything is a smart contract and then coming to wallets everything is a smart account which by Design which makes it much more powerful on these

features okay now let's go through that so how AA works this just a graphical presentation so you have your client in the wallet it has a key then you have your account the smart contract which two functions typically validate and execute a transaction and then well you sign a transaction it goes through the account validation execution and then it will call AEP okay so first thing multi calls I mentioned we would like to have everything one click so today on ethereum and so on I mean it's not if you want have you need to have one transaction per call right and finally we have multi calls here so we just

program the account in a way that it supports it so you go through the first call the outcome of this goes to the second call and so on so on but you can do this then in one transaction which is much better and we get finally rid of um esc20 approve uix which we still have on most chains on St maget you already today all deps like defi deps um yeah it's just one click and they do the multi call with the approve behind it which is much more intuitive okay another idea is the pay master so getting rid of transaction

fees so I mean adep could decide for the first whatever 10,000 users to onboard them um let's just pay for the transactions and there multiple way ways to do that and here is one or the way stocket will most likely do it it's not fully there um but you will have a de pay Master smart contract and then it works like that a client on the dep would say no I don't want to pay for this transaction will specify who should pay I mean it's a the smart contract basically of the Deb and then um it will go through the account the account will ask this step pay Master this thing will run its validation logic I mean basically depending do they want to pay for this transaction or not and if yes it will go

through and this would enable yeah very smooth onboarding for new users because they could just play around with things okay another um thing which we would like to have is uh account recovery with guardians so to get rid of the problem like oh you forgot to back up your seat phras you're doomed so um um we could do something like or we have done this actually on Argent like already on ethereum but we do it here as well um you would introduce a recovery service which has a second key right and this second key the only thing it can do it can recover in the case you lose your

key so and this we can again Implement on the account to make this possible so let's say there is this bad day you lose your wallet and your keys then you need to authenticate to the recovery service and then um the recovery service can basically enable your new key on the account and then you you're back basically um you might say like ah I don't like these recovery service is this an entity or whatever you could also say okay you can go you can use a ler as a recovery mechanism right or you could say uh no I want to assign this to let's say three of my best friends and

they should be the Guardians in case I lose access to my wallet um that's another option so it's actually quite simple with account abstraction to implement these things on the account and yeah we have done this already so another powerful idea is fraud detection with tofa so again you could um introduce a second key um on the fraud monitoring service and now you would change the the logic on the account in a way that um you would need every transaction needs to be co-signed by the fraud monitor as well and then how it would work if you're on a you're doing something on a

dab so basically the wallet will um send the raw transaction data um to the fraud monitoring service and this can run in all kinds of checks like do you really want to send to this address nobody has seen this before um you you can check like oh you're moving whatever 95% of all your assets on the wallet to this malicious address I mean there there are many very sophisticated solutions to do these checks and then it's like okay if it says no it's fine it will just coign it and the transaction fully transparent to the user will then go through and execute or if it's suspicious it will challenge you with a TFA challenge like

on another Channel email or something ask is it really you right like people know from I mean also typical TF a experience in the web too and then you can still decide if that's really what you want to do or not um so that's and this is enforced here right like with on chain because we have these two keys good another cool thing you can do is the idea of session keys so we want to get rid of all these approvals right the complexity so here consider a game which wants to do lots of transactions with the user because I mean it's an onchain experience you need

to I don't know buy bricks this is yeah basically a game to build nfts out of bricks you need to buy it you need to assemble it all kinds of things so and every time you need to bother the user right with the wallet like sign this sign this and so on but with session Keys you can remove this so you would only ask the user once for an approv key a session key and say like but with a with a um specific scope right so like um we want to start a session and we want to spend maximum 10 die and on these operations and it will expire in one hour right this is what the UI shows and then um the user can like oh yeah

that's fine for me I that's okay I confirm and then assign token basically kind of a temporary key will go back to the de and then from now on the wallet is basically invisible right you don't need it anymore the Deb can directly interact and do these things if you click somewhere which is much much smoo so we are working on this as well good last one go passwordless with Web Concepts like web or than or pass keys so yeah um you might know like I mean on a secure cave on your mobile um there's yeah we we in theory we always could use

this directly to sign transactions but the problem is the C cryptography which is used on these secure enclaves is not compatible with most blockchains today so basically this elliptic curve which we are using is not the right one so um but that's not a problem with account abstraction we can basically put the logic there that we need and support this and then it allows that you can directly you can sign with your mobile directly transactions also using the biometric of mobile um yeah which is obviously a smoother um experience and yeah these are the related to the concept weapos and and pass key so

yeah to recap users um just want applications they don't want wallets or chains and all these things right I think it's pretty clear and we need to remove all the friction by bringing the best of web two and web 3 without compromising self- custody and account abstraction is the key to do that right it basically if you do all of that we have a very smooth uix um and yeah users are safer with recovery and all that things and this is not just theoretical so we at Argent have built um a wallet which is um much more focused on this uh which is the web wallet which can be directly integrated

into deps and I brought a little video which would be cool to show so yeah you log in with email connected you can do your stuff I mean that's just this swap y this shows how easy it is to integrate for [Music] developers yep okay and last

slide wh yeah and this is live with more than 15 deps on starnet already um like all kinds of like nft marketplaces kind of an ens games and um all the amm and yeah if you are interested you can scan the QR code that we go directly to the web wallet SDK and um yeah I think this is um ah and it has uh obviously smart contracts have an audit also the web wallet has a secur audit um so yeah we took what we can care of that and that brings me to my last slide

yeah thanks everyone and I would open for [Applause] questions um questions yeah uh are you planning to bring the solution to Native iOS or and Android and which could be the challenges when moving to these kind of platforms yes so I mean we have uh um for many years Argent started with a mobile app like I think it's already four or five years there um and it's native Native apps on IOS and Android and we have also launched now on starnet

and yeah we will bring I mean a few of the things are there like multi call and all that stuff is already working obviously but things like session keys and so on what the webo and thing we are working on that yeah but yeah there will be challenges for sure because like you have the Apple ecosystem with Pas key is a bit different than the Google thing so yeah but that's basically in the progress yeah thank you um does anyone else have any questions we still have a few minutes until the next talk um I think I didn't quite follow where

the like where the private key actually is like where is the the use because so so it's non-custodial but they don't have a seed phrase so H how does that actually where where does all the secret data live and yeah so I mean on on it depends now on which wallet mechanism um so it doesn't have a seat phrase um we might have obviously a private key because we still need to sign right but um then um I mean as with the mechanism I've I've shown um you could have another key recovery service and then later if you lose it right it's not a big deal because we can recover um basically with a new key your account on chain so there it's basically CIO right I mean if somebody else if somebody else

has got the key then that's kind just as good just the same as being CIA does that mean uh yeah now it depends on on the mechanism so yes if there is just one key and somebody else somehow gets access but it will be I mean in Mobile it is pretty hard to get to this key um or so that that's not an issue um if the let's say we use the the the fraud monitor mechanism there is also a second key right which needs to sign every transaction so if you lose yours then um you have actually it's not enough actually you would also need to be able to authenticate to to the fra service or or arent in today but could be others um

that it's you to to get the second signature so there is other mechanisms in place if you just lose the first private key yeah but yeah and in general right like if you want to have more and more I mean you would go for a multi sick at some point yeah uh hi hi um I've been following arent for a while and you had a great adoption rate in the beginning yeah one one of the things that made it slow down was when

you could not provide the gasless experience anymore yes that's correct and I still see you proposing the pay Master as a great feature to onboard more users yeah I think that runs into the risk of having the same problem again once gas fees rise again I know you're on Stark net now yeah but what are the gas savings there compared to main net maybe a 2/3 less oh no it's it's a lot a lot um so um right now for normal transaction I think you're are 30 to 50 Cent um per transaction but okay that's

that's comparable like on to ethereum on Main net you pay less than a dollar to just but just today right because we don't have much going on I mean I paid much more in in other years so right now yeah okay it it's it's it's going long but I mean there is more so basically um I mean what is expensive today is still um the storage right so the the data Avail availability to push it to ethereum that that's what takes most of the cost and there is also I mean I think like other chains as well stocket will bring volition which is another data Avail availability layer and then we go into sub 10cent area of

transaction cost so it will go lower and lower yeah that's that's where we are today um so I mean it depends also then on the on the dep right maybe they have a different way um to to to to yeah basically to make money so they can subsidize it then I'm I'm not sure if v as arjent can do it like we had it in the beginning we loved it and it it proved actually that it works and that we were kind of right on the ideas but yeah if your main net cost just killed it so yeah um any further questions

um if not thank you so much Tom Thomas thank you