Implementing Social Recovery for Mobile Crypto Wallet
Social Recovery allows regaining wallet access without seed phrase — via trusted people (guardians). User lost phone, doesn't remember seed — guardians confirm owner change. Mechanics work at smart contract level, mobile is UX layer.
How It Works at Contract Level
Candidate standard — EIP-2525 (not finalized) with implementations in Safe, ZeroDev, Argent. Basic logic:
- Wallet — smart account (ERC-4337 or custom).
- On setup owner sets guardian list (addresses) and threshold (N of M).
- On access loss: guardians confirm
initiateRecovery(newOwner). - After collecting N signatures and optional timelock (24–72 hours) —
finalizeRecoverychanges owner.
Mobile implements: guardian setup screen, recovery initiation flow (on new device), confirmation screen (for guardians).
Who Are Guardians Technically
Options: other wallets (addresses) of trusted people, email via ZK-Email Guardian (verify email without content exposure), hardware wallet, another smart account.
For mobile app most practical — guardian addresses of other app users. Flow:
- User A adds guardian → enters address or scans User B QR.
- User B gets push and accepts/rejects guardian role.
- Accepting guardian role —
addGuardianin User A's wallet contract.
Recovery Flow on New Device
User installs app on new device. Generates new keypair. Initiates recovery with new address — sends request to guardians via push/email.
Each guardian sees: whose wallet recovers, new address, request timestamp. Confirms via own wallet — approveRecovery UserOperation.
Timelock critically important: if owner compromised (not lost), timelock gives time to cancel fraudulent recovery via cancelRecovery with original key.
What's Hard to Implement
Off-chain state. Guardian not always online when recovery needed. Need centralized notification queue or push mechanism. Without this recovery hangs.
Guardian removal. If user falls out with guardian — need removal flow. removeGuardian via owner key. What if owner key lost? Then only through other guardians with raised threshold.
Status display. User sees: "2 of 3 guardians confirmed, waiting for 1, timelock expires in 18 hours". This polling contract or event subscription via WebSocket (eth_subscribe).
Process
Audit existing contract architecture (or choose from ready: Safe, ZeroDev). Implement guardian setup UI, recovery initiation and confirmation flow, push notifications for guardians, recovery status monitoring.
Timeline — 3–5 days for existing smart account with Social Recovery already in contract. If contract needs writing — separate scope. Custom pricing after requirements analysis.







