scrtlabs / Grants

Repository for grant proposal submissions
38 stars 28 forks source link

Smart Account Standards for Dapps: Registries & Accounts #157

Open kromsten opened 2 months ago

kromsten commented 2 months ago

Overview

The niche of smart contract-based accounts and blockchain abstraction is rapidly growing. It is becoming increasingly important in the light of providing better UX for the users and carving a path for mass adoption.

There is already a significant number of applications and initiatives based on this concept such as Obi.money and Unstoppable Wallets that are built on top of the Secret Network.

In addition to that there is quite a big number of projects being built using nearly identical plain CosmWasm or on widely known EVM. It's expected for them to be ported to the ecosystem or completely new interesting idea to emerge in near future

This diversification makes it challenging for dApps to keep up with increasing number of solution providers, to understand what custom authentication methods a user might have in addition to standard cosmos wallets and also to successfully reuse the primitives created in other parts of the ecosystem in a sustainable manner.

Our grant seeks to address these challenges by proposing a unified solution with addition to capitalizing on the unique features of the Secret Network

Problem Statement

Next generation of the decentralised applications relying on power of account abstraction might encounter various challenges.

In a simple scenario where a user opens an app for the first time he can have in possession one of the many provable credential technologies, such as (Web3) Wallets, OAuth 2.0, (WebAuthn) Passkeys, Login & Passwords and so on. Dapps developers might puzzle themselves with the following:

Some applications might use a custom authentication mechanism either not supported by popular providers or it can be an overkill to use them. For example, a dapp might need a simple account contract controlled by Ethereum signatures. In such cases, the following questions must be answered:

In some cases, data about smart contract-based accounts might be needed from another smart contract inside a virtual machine. In such cases, 3rd party networks and solutions relying on API keys become unusable. Interaction with pure on-chain solutions still remain challenging in the following scenarios:

There are multiple brilliant teams working on using abstract accounts for "wallet experience" focusing on very needed features such as spending limits, session keys, intents and so on. When it comes to consumer-facing application the field is being rather neglected, infrastructure almost non-existent and entry-level requires getting a PHD in both software design and applied cryptography

Proposed Solution

We are proposing to port the account standards we recently developed for regular CosmWasm cw[81-83] to their respective "snip" versions and enhance them with the privacy-specific aspects of the Secret Network. In addition to that we propose to build a reference implementation that can be integrated into any dApp in the ecosystem and a simple interface for demo purposes to showcase it

From a high-level perspective, the solution includes an account Registry (cw83 -> snip83) and minimalistic contract-based Accounts (cw82 -> snip82).

The Registry binds a provable credential or a list of credentials to smart contracts (typically accounts). It allows those holding private parts of credentials to modify crucial data on the bound account contracts and to migrate them to newer code versions. Additionally, a registry must expose a query method that reveals whether there is an existing (account) contract matching a given credential, what is contract address, and optionally additional account data (e.g code hash).

The Account standard is very minimalistic and only requires contracts following it to determine whether a given signature can be considered valid according to its interpretation, whether a certain action (CosmosMsg) can be executed, and to actually execute that message.

The two standards work well together, but they do not necessarily require each other. A Registry can create accounts that do not follow the snip82 standard, and snip82 accounts can be created by any custom registry or even manually by a user. However, a specific implementation might enforce a flow where the other is required.

Implementation Ideas

Deliverables

Main

Byproducts Beneficial for the Ecosystem

Details

New "SNIPS" are expected to be released in a separate repository. Upon interest some of them might be merged into secret-toolkit or a another repository that is maintained with bigger resource allocation. Naming is to be determined later for colliding versions (mainly cw22 and already existing snip22)

Credential type definition and verification logic will be defined in a separate library intended to support multiple rust based virtual machines at the same time. Support for Secret Network will be added under a new respective feature tag

List of credentials supported currently:

Milestones & Expenses

Each bullet point from the main section is estimated to be a milestone with first 2 taking 1 weeks per milestone and the last two lasting for around 1.5 weeks each. = 5 weeks total. In case of unforeseen contingencies we might anticipate a delay of 1 - 1.5 more week which won't requiring extra allocations

First milestone is the only to not have any tangible KPIs. The rest are expected to be immediately deployed to the testnet and static hosting after completion and to be interactable from cli and browser respectively right after that

Allocated hours per week from each team member are 5, 15 and 30 (in the order below) with the development expenses covering the whole team being ~$3,600 per week

Total Ask (for 5 weeks): $18,000

Team & Experience

Day: Design / Graphics / Communication

Graphic Designer with background in data science. Interest in web3 was started with NFTs. After initial research the whole field become one of the primary interests alongside with AI both of which she's been actively working on for the last 3 years. Still finds NFTs fascinating after all this time and enjoys exploring their potential
Fun fact: Doesn't get PFPs. Rejected an offer for getting a Bad Kid once. Had some regrets about that after recent price action and airdrop mania

Elbok: Project Management / Testing / (Sys)Administration / Research
Technological polyglot knowing a bit of everything across various engineering fields including deep database knowledge, machine learning algorithm and low-level programming with C. Knows about web3 as much as the core engineer if not more but doesn't do open source as often and is way less boastful more discreet person enjoying his privacy

Fun fact: Never used an actual bank. The closest thing was CEX and their "crypto" debit cards. Even that is gone now after moving to non-custodial card issuers and DEXes

Kromsten: Core Engineer / Architecture / Research / Building
Software Engineer specialising in decentralised applications with 7+ years of experience in web development. Have worked with almost every mainstream technology out there but have been primarily focusing on Cosmos ecosystem.
Fun fact: Only worked in traditional web development for a year in 2017. After that started playing with EVM initially and shortly after got a first work gig in web3 which happened to be in Secret Network ecosystem (SEFI airdrop by ChainOfSecrets)
Personal Relevant Experience:

Team Experience

(Stargaze) Token-Bound-Accounts - The most developed reference implementation of the proposed standards at the moment. Showcases dealing with bug number of design challenged such as custom chain messages, decentralisation & governance control, extendable natures of the local NFT standards. Additionally goes to deep extend of engineering through advanced features of template engines to follow the conventions and provide high degree of customisation

CW-Extra - Experimental standard, packages, proof of concepts and other novel ideas for CosmWasm (and SecretWasm) based contracts. Includes a secret-network branch imitating (and partially doing) implementation of the proposed standards

Future & Growth

The grant falls under the category of development tooling and partially under network improvements. As such it is not expected to have a clearly defined "go-to-market" strategy as itself. Instead deliveries of the grant proposal paves path to new implementations open many new possibilities, promote better user experience and drive adoption forward

Next Steps

Next natural step for the project after deliverables would be:

Future Plans

A topic of account abstraction in context of dapps (VS Wallet Experience) has been a focus of our team for a while and we've been working on it across various ecosystems. We've been trying to do so in a sustainable matter that promotes re-usability

We have multiple planned improvements to common libraries & new products interoperable with the proposed grant project by design. It's quite likely that after finishing them they can be easily ported to Secret without big expenses and a separate grant requests. The list includes: