Is Session Key the Game Changer in Web3?

session keys

The potential of session keys has become a hot topic again, especially with ERC3074 set to be part of the Pectra upgrade. This development has sparked conversations across the Web3 community.

[embed]

So, What Are Session Keys and How Do Session Keys Work?

Here let me quote a paragraph from ZeroDev docs. They have the most concise and precise explanation on what are session keys:

Session keys are the JWTs of Web3. Much like JWTs, session keys are cryptographically signed — in this case, with your master key. Like JWTs, session keys encode “scopes” within themselves that specify the actions they can perform.

In general implementation, session keys are generated no matter on-chain or off-chain. The AA (Abstract Account, we will have another article to talk about it later) wallet’s signer needs to submit the key to a smart contract, says Key Validator Contract, which is used to store the key and the corresponding permissions scope. When we use the Key Validator Contract as a middleware, we can submit the transaction on behave of the AA wallet now.

It solves one of the largest pain point in the current industry, the unfriendly user experience. For example, nowadays if a new user want to swap a ERC20 to another on Uniswap or want to list an NFT on Opensea, the user has to sign a message first for approving the Uniswap contract or the Seaport contract for controlling their tokens, and then the user needs to sign another message for the actual operation that they want to (swap token/ list an NFT). With the help of session keys, the user only need to sign once to delegate the session key to sign the message on any marketplace or exchange on behalf of them.

Service Providers Supporting Session Keys

Currently, most of the AA wallet service providers have implemented support for session keys. And, every provider has their own custom features on the session keys. Here are a few famous providers:

• **Alchemy**
• **ZeroDev**
• **ThridWeb**
• Bitconomy

Let us drill into Alchemy SDK as an example

Alchemy’s session keys offer a robust mechanism for managing and controlling access to smart accounts, standing out through their emphasis on security and flexibility. Designed for temporary access, Alchemy’s session keys provide granular permissions and time-bound validity, ensuring that the risk associated with key compromise is minimized by limiting the scope and duration of access. This approach is ideal for scenarios where temporary and controlled access is needed without sharing private keys. By focusing on precise control over what actions can be performed and for how long, Alchemy’s session keys enhance security and usability, offering a versatile solution for managing smart account interactions in a secure and efficient manner. This contrasts with other session key providers, which may focus more on specific use cases like smart contract delegation or session validation, making Alchemy’s solution particularly suitable for applications requiring comprehensive security and controlled access.

Step-by-Step Workflow using Alchemy SDK:

1. Create Signers: Use the LocalAccountSigner from a mnemonic to create session key signers.
2. Check Plugin Installation: Ensure the session key plugin is installed on the account, which means it checks whether the session keys are submitted to the SessionKeyPlugins contract along with its permissions
3. Install Plugin: If not installed, set initial permissions and submit the key to the SessionKeyPlugins contract
4. Execute Operations: Use the session key signer to execute user operations securely.

Belows are the flow chart and users flow diagram which may help on understanding the completed steps.

Alchemy SDK’s Flow Chart:

Alchemy SDK’s User Flow Diagram:

More Use Cases of session keys

In GameFi

• Players are often required to sign multiple transactions. This frequent need for approvals disrupts gameplay and leads to a cumbersome and frustrating experience, detracting from the overall enjoyment and fluidity of the game. By using session keys, the approval process becomes more seamless, allowing players to focus on the game itself without interruptions, thereby improving engagement and satisfaction.

In DeFi

• Algo-trading in decentralized exchanges (DEXs) can be made more secure and efficient with session keys, which allow third-party plugins to trade on behalf of users while minimizing risk. Currently, algorithmic trading is typically confined to centralized exchanges (CEXs) due to security concerns. By leveraging session keys, the security and efficiency of algo-trading can be enhanced, enabling it to transition from CEXs to DEXs and providing users with a safer and more streamlined trading experience.

In Daily Life

• In everyday life, as more corporations begin to accept crypto payments, session keys enable auto-payments, making the process as seamless as traditional financial systems. Currently, manual crypto payments are inconvenient for recurring transactions. By using session keys, recurring crypto payments can be automated, enhancing convenience and efficiency for users, similar to Visa’s Automated Transactions Solution.

Relation to ERC3074

ERC3074 introduces two new functions to externally owned accounts (EOA) wallets: auth and auth_call, which are comparable to user operations (userops) and account abstraction (AA) wallets as defined in ERC4337. This enhancement significantly broadens the use cases for session keys, facilitating a wider adoption of Web3 applications in everyday life.

Future Implications

Integrating session keys with ERC3074 functionalities promises more seamless and secure interactions within the Web3 ecosystem. This development will enable more efficient and user-friendly experiences, fostering greater trust and usability for Web3 applications. As session keys become more integrated with these advanced functionalities, the potential for innovative applications and services within the decentralized space will expand, making Web3 interactions more accessible and reliable for users.Conclusion

Session keys represent a significant leap forward in Web3 usability and security, particularly with the upcoming ERC3074 upgrade. Their ability to facilitate more efficient and secure transactions can drive broader adoption and innovation in decentralized applications.

References

• Alchemy Docs for Session Keys
• Alchemy SDK for AA Wallet
• Session Key Plugin Contract Code & Docs

Follow me on Medium for more insights and practical examples of Web3 technologies. In my next article, we’ll dive into Abstract Account wallets — ERC 4337 in a hands-on session.