Skip to main content

Passkey Recovery

General Provisions and Scope​

The DEUSS platform utilizes WebAuthn Passkeys as the primary authentication and signing mechanism for on-chain interactions via ERC-4337 Smart Accounts. This completely eliminates the need for seed phrases. However, if a user loses access to their device or authenticator, they must undergo a Passkey Recovery process to regain control of their account and associated on-chain assets.

This process involves replacing the lost passkey with a newly generated one, both in the off-chain Registry Service database and on the blockchain within the user's Smart Account.

Development Environment Notice:

  • Current State (Staging / Dev): The passkey is successfully replaced off-chain in the Registry Service (UserService), but the on-chain blockchain transaction is currently stubbed out and intentionally bypassed.
  • Target State (Production Environment): The Registry Service must construct and broadcast an on-chain transaction to the user's Smart Account to revoke the old public key and authorize the newly registered passkey.

Business Flow​

  1. Recovery Initiation:

    • The End User securely proves their identity (via backend validation flows or administrative support) and initiates the recovery process on a new device.
    • The device's local authenticator generates a new WebAuthn passkey (keyId and publicKey).

  2. Off-Chain Registration:

    • The Whitelabel frontend submits the new passkey to the Registry Service.
    • The Registry Service fetches the user's current profile, completely deletes the old compromised/lost passkey from the database, and saves the new UserPasskeyEntity.

  3. On-Chain Smart Account Update (Target State):

    • The Registry Service bridges to the blockchain, invoking the recovery function on the user's associated Smart Account contract.
    • The old public key is invalidated, preventing any transactions signed by the lost device from executing.
    • The new public key is registered as the primary signer.

  4. Completion:

    • The user is notified of the successful recovery. They can now immediately resume signing transactions (such as placing offers or updating their company data) using their new device.

Sequence Diagram​