The problem Forgetless Wallet solves

The Problem It Solves

The Seed Phrase Problem

Every crypto wallet today forces users to backup a 12-24 word recovery phrase. This creates a fundamental UX barrier:

• 23% of all Bitcoin is lost forever (~$140B) because people forgot, lost, or never properly stored their seed phrases
• 29% of crypto users have lost access to funds at some point
• New users are immediately confronted with security anxiety before they can even use their wallet
• The choice is brutal: memorize random words, trust a custodian, or risk losing everything

What Forgetless Wallet Does

Forgetless Wallet replaces seed phrases with your fingerprint.

Instead of writing down 12 words and hiding them somewhere "safe," you authenticate with the biometrics already on your device - fingerprint, Face ID, or PIN. Your cryptographic keys are stored in your device's secure enclave (the same technology protecting your Apple Pay and Google Pay), and automatically sync across your devices via iCloud Keychain or Google Password Manager.

How It Makes Crypto Easier & Safer

For New Users

• Zero onboarding friction - Create a wallet in seconds with just a fingerprint scan
• Nothing to memorize - No seed phrases, no passwords, no recovery codes
• Familiar experience - Works like logging into your banking app

For Experienced Users

• Non-custodial security - Your keys never leave your device's hardware security module
• Phishing resistant - Passkeys are cryptographically bound to the correct website
• Cross-device access - Your wallet syncs automatically between phone, tablet, and laptop

For Sending & Receiving

• Deposit from any wallet - Friends can send you crypto from MetaMask, Coinbase, Trust Wallet, or any EVM wallet
• Withdraw to anywhere - Sign with your fingerprint to send funds to any blockchain address
• No vendor lock-in - Your funds are always accessible, not trapped in a proprietary system

For Peace of Mind

• No single point of failure - Device lost? Your passkey is synced to your cloud account
• Hardware-level protection - Keys stored in tamper-resistant secure enclaves
• Replay attack protection - Every withdrawal uses a unique nonce and time-limited deadline

The Bottom Line

Forgetless Wallet makes self-custody as simple as unlocking your phone. You get the security of a non-custodial wallet without the anxiety of seed phrase management. It's crypto the way it should have been from the start.

Challenges I ran into

1. Parsing WebAuthn Signatures for On-Chain Verification

The Problem:
WebAuthn returns signatures in a format that Ethereum smart contracts can't directly verify. The P-256 signature from a passkey comes wrapped in CBOR-encoded authenticator data, and the public key coordinates are buried in a COSE key structure.

The Struggle:
I spent days trying to extract the raw r and s values from the WebAuthn response. The signature is ASN.1 DER encoded, meaning the length bytes are variable. A signature that worked on one test would fail on another because the r or s value had a leading zero byte that changed the offset.

How I Solved It:
I wrote a custom decoder that handles variable-length ASN.1 integers

2. Building the EIP-712 Challenge for Passkey Signing

The Problem:
The smart contract verifies withdrawals using EIP-712 typed data signatures. But WebAuthn doesn't sign arbitrary data - it signs a SHA-256 hash of authenticatorData + SHA256(clientDataJSON). I needed to make these two worlds meet.

The Struggle:
The challenge has to be embedded in the clientDataJSON.challenge field as a base64url-encoded string. But the smart contract expects to recover a signer from an EIP-712 digest. Getting the encoding chain exactly right took many failed transactions.

How I Solved It:
I build the EIP-712 struct hash on the frontend exactly as the contract does

Then encode this digest as base64url for the WebAuthn challenge. The contract reconstructs the same digest and verifies the passkey signature against it.

3. Cross-Browser Passkey Compatibility

The Problem:
Different browsers and operating systems handle passkeys differently. Safari on macOS syncs to iCloud Keychain. Chrome on Android uses Google Password Manager. Some browsers don't support passkeys at all.

The Struggle:
Users on older browsers or unsupported platforms would hit cryptic errors. Firefox on Linux had partial support. Mobile browsers behaved differently than desktop. I couldn't just let users fail silently.

How I Solved It:
I built a PasskeySupport component that detects the environment before letting users proceed

Users on unsupported browsers see a clear message explaining what they need, rather than a confusing error after they've already tried to create a wallet.

4. Credential ID as User Identity

The Problem:
Traditional wallets use the public address as identity. But with passkeys, the credential ID is what identifies a user on-chain. This is a 64+ byte random value that's not human-readable.

The Struggle:
How do you tell someone "send funds to my wallet" when your identifier looks like 0x7f2a9c8b4d... and is 150 characters long? QR codes help, but copy-paste is error-prone.

How I Solved It:
I built a CredentialIdDisplay component that:

• Shows a truncated version by default (0x7f2a...8b4d)
• Provides one-click copy to clipboard
• Generates a QR code for mobile scanning
• Shows the full ID on hover/click for verification

The key insight: treat it like a bank account number. Users don't memorize it - they copy it or scan it.

Key Takeaway

The hardest part wasn't any single bug - it was bridging two different cryptographic worlds (WebAuthn and Ethereum) that were never designed to work together. Every step of the signature flow had to be carefully aligned between what the browser produces and what the smart contract expects. Getting it wrong meant silent failures with no helpful error messages.

The solution was always the same: understand exactly what bytes each system expects, log everything during development, and verify each step independently before combining them.