ERC-7947: Account Abstraction Recovery Interface

Universal mechanism to recover a smart account's ownership via custom recovery providers.

Metadata

Status: DraftStandards Track: ERCCreated: 2025-05-07

Authors

Artem Chystiakov (@arvolear) (artem@rarilabs.com)

Links

GitHub page Discussion on Ethereum Magicians

Abstract

Introduce a universal account abstraction recovery mechanism recoverOwnership(newOwner, provider, proof) along with recovery provider management functions for smart accounts to securely update their owner.

Motivation

Account abstraction and the "contractization" of EOAs are important Ethereum milestones for improving on-chain UX and off-chain security. A wide range of smart accounts emerge daily, aiming to simplify the steep onboarding curve for new users. The ultimate smart account experience is to never ask them to deal with private keys, yet still allow for full account control and ownership recovery. With the developments in the Zero-Knowledge Artificial Intelligence (ZKAI) and Zero-Knowledge Two Factor Authentication (ZK2FA) fields, settling on a common mechanism may even open the doors for "account recovery provider marketplaces" to emerge.

The account recovery approach described in this proposal allows for multiple recovery providers to coexist and provide a wide variety of unique recovery services. In simple terms, smart accounts become "recovery provider aggregators", making it possible for the users to never rely on centralized services or projects.

The Account Abstraction Recovery Interface (AARI) aims to define a flexible interface for any smart account to implement, allowing users to actively manage their account recovery providers and restore the ownership of an account in case of a private key loss.

Specification

The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

A smart account willing to support AARI MUST implement the following interface:

A recovery provider MUST implement the following interface:

Rationale

The AARI is expected to work with any account abstraction standard to allow for maximum account recovery flexibility. Whether it is EIP-4337 or EIP-7702, a particular smart account provider may support account recovery by simply implementing a common interface.

Since the whole account recovery process is nothing but proving the knowledge of some alternative secret to a private key, it is essential for accounts to be able to "commit" to this secret. The subscribe function in the recovery provider interface allows precisely for that. Moreover, if at some point in time a user wanted to "recommit" to a new secret (due to security reasons), they could multicall unsubscribe + subscribe functions to achieve the desired result.

Backwards Compatibility

This EIP is fully backwards compatible.

Security Considerations

There are several security concerns to point out:

It is up to a smart account developer to properly access control addRecoveryProvider and removeRecoveryProvider functions.
A smart account user may be "phished" to add a malicious recovery provider to their account. In that case, a recovery provider may gain full control over the account by accepting fake recovery proofs.