Account Abstraction Explained: ERC-4337 Smart Accounts

Smart Contracts

2025-05-23

account-abstraction-erc-4337-smart-accounts-cover

ERC-4337 enabled 13M+ smart accounts by 2025. How account abstraction, gasless transactions, social recovery, and the EntryPoint contract work for builders.

Frequently Asked Questions

Account abstraction lets a smart contract act as your wallet instead of a private-key-only Externally Owned Account. The contract can enforce custom rules: multiple signers, spending limits, biometric login, session keys, or gasless transactions. ERC-4337 delivers this on Ethereum without changing the base protocol, and by mid-2025 more than 13 million smart accounts had been deployed across EVM chains.

ERC-4337 introduces a separate mempool for UserOperation objects. Bundlers pick them up, batch them, and submit a single transaction to a singleton EntryPoint contract at 0x0000000071727De22E5E9d8BAf0edAc6f37da032. The EntryPoint validates each UserOperation against its smart account, pays gas (optionally reimbursed by a paymaster), and executes the call. No changes to the Ethereum consensus layer are needed.

ERC-4337 gives you a fully new smart-contract wallet address. EIP-7702, activated on Ethereum mainnet in the Pectra upgrade on May 7, 2025, lets an existing Externally Owned Account temporarily delegate its code to a smart contract for the duration of a transaction. EIP-7702 upgrades the wallets people already have; ERC-4337 provisions native smart accounts from scratch. They are designed to be complementary.

The gas is always paid, but not by the user. A paymaster contract, funded by the application or a sponsor, reimburses the EntryPoint. Users can also pay fees in USDC or any ERC-20 instead of ETH through an ERC-20 paymaster. To the end user the transaction looks free or feels like a normal app payment, but on-chain economics are unchanged.

Well-audited smart accounts like Safe{Core}, Kernel, and Biconomy's Nexus have been running with billions in cumulative volume since 2023 with no EntryPoint-level exploits. The main risks are application-layer bugs in the account contract itself and malicious paymaster policies. Always use an audited implementation and verify the EntryPoint address, as a single canonical EntryPoint per version is deployed at the same address across every major EVM chain.