Forgetless Wallet
You will never forget you funds again !!
About
The problem it solves # The Problem It Solves ## The Seed Phrase Problem Every crypto wallet today forces users to backup a 12-24 word recovery phrase. This creates a fundamental UX barrier: - **23% of all Bitcoin is lost forever** (~$140B) because people forgot, lost, or never properly stored their seed phrases - **29% of crypto users** have lost access to funds at some point - New users are immediately confronted with security anxiety before they can even use their wallet - The choice is brutal: memorize random words, trust a custodian, or risk losing everything ## What Forgetless Wallet Does **Forgetless Wallet replaces seed phrases with your fingerprint.** Instead of writing down 12 words and hiding them somewhere "safe," you authenticate with the biometrics already on your device - fingerprint, Face ID, or PIN. Your cryptographic keys are stored in your device's secure enclave (the same technology protecting your Apple Pay and Google Pay), and automatically sync across your devices via iCloud Keychain or Google Password Manager. ## How It Makes Crypto Easier & Safer ### For New Users - **Zero onboarding friction** - Create a wallet in seconds with just a fingerprint scan - **Nothing to memorize** - No seed phrases, no passwords, no recovery codes - **Familiar experience** - Works like logging into your banking app ### For Experienced Users - **Non-custodial security** - Your keys never leave your device's hardware security module - **Phishing resistant** - Passkeys are cryptographically bound to the correct website - **Cross-device access** - Your wallet syncs automatically between phone, tablet, and laptop ### For Sending & Receiving - **Deposit from any wallet** - Friends can send you crypto from MetaMask, Coinbase, Trust Wallet, or any EVM wallet - **Withdraw to anywhere** - Sign with your fingerprint to send funds to any blockchain address - **No vendor lock-in** - Your funds are always accessible, not trapped in a proprietary system ### For Peace of Mind - **No single point of failure** - Device lost? Your passkey is synced to your cloud account - **Hardware-level protection** - Keys stored in tamper-resistant secure enclaves - **Replay attack protection** - Every withdrawal uses a unique nonce and time-limited deadline ## The Bottom Line Forgetless Wallet makes self-custody as simple as unlocking your phone. You get the security of a non-custodial wallet without the anxiety of seed phrase management. It's crypto the way it should have been from the start.
How it's made
Challenges we ran into ## 1. Parsing WebAuthn Signatures for On-Chain Verification **The Problem:** WebAuthn returns signatures in a format that Ethereum smart contracts can't directly verify. The P-256 signature from a passkey comes wrapped in CBOR-encoded authenticator data, and the public key coordinates are buried in a COSE key structure. **The Struggle:** I spent days trying to extract the raw r and s values from the WebAuthn response. The signature is ASN.1 DER encoded, meaning the length bytes are variable. A signature that worked on one test would fail on another because the r or s value had a leading zero byte that changed the offset. **How I Solved It:** I wrote a custom decoder that handles variable-length ASN.1 integers ## 2. Building the EIP-712 Challenge for Passkey Signing **The Problem:** The smart contract verifies withdrawals using EIP-712 typed data signatures. But WebAuthn doesn't sign arbitrary data - it signs a SHA-256 hash of `authenticatorData + SHA256(clientDataJSON)`. I needed to make these two worlds meet. **The Struggle:** The challenge has to be embedded in the `clientDataJSON.challenge` field as a base64url-encoded string. But the smart contract expects to recover a signer from an EIP-712 digest. Getting the encoding chain exactly right took many failed transactions. **How I Solved It:** I build the EIP-712 struct hash on the frontend exactly as the contract does Then encode this digest as base64url for the WebAuthn challenge. The contract reconstructs the same digest and verifies the passkey signature against it. ## 3. Cross-Browser Passkey Compatibility **The Problem:** Different browsers and operating systems handle passkeys differently. Safari on macOS syncs to iCloud Keychain. Chrome on Android uses Google Password Manager. Some browsers don't support passkeys at all. **The Struggle:** Users on older browsers or unsupported platforms would hit cryptic errors. Firefox on Linux had partial support. Mobile browsers behaved differently than desktop. I couldn't just let users fail silently. **How I Solved It:** I built a `PasskeySupport` component that detects the environment before letting users proceed Users on unsupported browsers see a clear message explaining what they need, rather than a confusing error after they've already tried to create a wallet. ## 4. Credential ID as User Identity **The Problem:** Traditional wallets use the public address as identity. But with passkeys, the credential ID is what identifies a user on-chain. This is a 64+ byte random value that's not human-readable. **The Struggle:** How do you tell someone "send funds to my wallet" when your identifier looks like `0x7f2a9c8b4d...` and is 150 characters long? QR codes help, but copy-paste is error-prone. **How I Solved It:** I built a `CredentialIdDisplay` component that: - Shows a truncated version by default (`0x7f2a...8b4d`) - Provides one-click copy to clipboard - Generates a QR code for mobile scanning - Shows the full ID on hover/click for verification The key insight: treat it like a bank account number. Users don't memorize it - they copy it or scan it. --- ## Key Takeaway The hardest part wasn't any single bug - it was bridging two different cryptographic worlds (WebAuthn and Ethereum) that were never designed to work together. Every step of the signature flow had to be carefully aligned between what the browser produces and what the smart contract expects. Getting it wrong meant silent failures with no helpful error messages. The solution was always the same: understand exactly what bytes each system expects, log everything during development, and verify each step independently before combining them.