Wallet-as-a-Service: Gasless Embedded Wallets for Ethereum Apps

Summary

Aligned Wallet-as-a-Service is embedded wallet infrastructure for applications on Ethereum. It creates a non-custodial wallet for each user during the product's normal sign-up, with no seed phrase or separate app to manage. Users authenticate with email or Google and approve transactions with a passkey, while Aligned submits each transaction and pays the gas. Every account is an EIP-7702 smart account whose two-signature rule is enforced on-chain, so no single party, including Aligned, can move user funds alone.

Key facts

• Aligned Wallet-as-a-Service gives every user of an application a non-custodial Ethereum wallet at sign-in, through a single SDK integration.
• Every account is an EIP-7702 smart account with a 2-of-2 rule enforced on-chain: the user's passkey and Aligned's backend must both sign every transaction.
• Users sign in with email or Google and confirm transactions with a passkey, with no seed phrase to write down and no gas token to buy.
• Wallets run on Ethereum L1 and on ZK rollups built with ethrex, LambdaClass's Rust Ethereum client. Each user keeps the same address on every chain, and Aligned pays the gas on every transaction.

Every user with their own balance on Ethereum needs a wallet. Teams that build their own into their onchain app must tackle key management, gas handling, and device recovery on top of working on their core product itself. Without an embedded wallet, their users are forced to bring their own external wallets, and all the seed phrases and gas fees that come with them.

Aligned Wallet-as-a-Service removes both burdens. It puts a non-custodial Ethereum wallet behind an onchain product's existing sign-in, so users can approve transactions with a passkey and never experience any gas fees. Institutions and individual builders are free to decide what this experience looks like, while Aligned supplies the underlying signing infrastructure, gas, and wallet recovery path.

What is wallet-as-a-service?

Wallet-as-a-service is infrastructure that delivers wallets as a built-in application feature, without project teams having to create everything from scratch. The wallet is embedded, meaning an SDK creates it during the product's own sign-up flow, so users never install an extension or write down a seed phrase. As a result, the product gains a wallet that is part of its own experience rather than an external one, without the need to manually stand up the underlying infrastructure.

Embedding a wallet also means deciding who can move user funds. If the product or its wallet provider can move them without the user's approval, it is a custodian, and custody comes with regulatory obligations. A non-custodial embedded wallet avoids that: users get a sign-in they already know, their transactions settle on Ethereum, and the product never holds their funds.

Embedded wallets have varying approaches to key ownership. A custodial provider holds them on users' behalf, which leaves the provider in control of the funds. On the other hand, a non-custodial wallet keeps signing power with the user. Aligned Wallet-as-a-Service is non-custodial, meaning its security model does not depend on users trusting the service.

What does onboarding an embedded wallet look like?

Onboarding with an Aligned embedded wallet is similar to opening a standard fintech account. Builders can decide whether new accounts can be created via an email code or a Google sign-in, and an SDK call registers the passkey and creates the wallet on-chain. From there, users can confirm each transaction with Face ID, a fingerprint, or a screen lock, directly within the app.

Aligned keeps every transaction gasless for the user: it submits each one and pays the gas, including the one-time transaction that creates the account. Users never need to hold the chain's native token.

The keys and the fees did not disappear. The seed phrase became a passkey in the device's authenticator, and the fees moved to Aligned's backend, which co-signs, submits, and pays. Users see a sign-up, a balance, and a confirmation prompt they already know from the other apps on their phone.

A traditional wallet adds setup steps, and each extra step costs new sign-ups. With those steps gone, fintechs and enterprises can onboard users to Ethereum in large numbers. If users never manage keys, who holds them?

Who holds the keys in an EIP-7702 smart account?

The user holds one key and Aligned holds the other, and neither can move funds alone. Every Aligned account is a smart account: a regular Ethereum account delegated via EIP-7702 to Aligned's smart-contract code. That code enforces a 2-of-2 rule, meaning a transaction is valid only with one signature from the user's device and one from Aligned's backend. The account's original key, which signs that delegation, is generated in memory by the SDK and discarded before the wallet is created, so no leftover key can bypass the rule.

Both signatures cover a digest bound to the chain, the account, its nonce, and the call parameters, so neither can be replayed on another chain or against another transaction. The user's side is a WebAuthn passkey, verified on-chain as a P-256 signature inside the WebAuthn envelope.

A breach of Aligned's infrastructure does not move funds, because the contract refuses any call without a valid user signature. A stolen device is not enough on its own either, because every transaction also needs Aligned's signature. Aligned's backend is one of two signers, never a custodian.

The rule itself is deployed bytecode at a public address. There is no enclave attestation to take on faith, and no ERC-4337 EntryPoint, bundler, or paymaster in the path. The account contract checks both signatures directly, and a compliance team can read exactly what it enforces. Each app has its own beacon contract, whose owner can rotate the signers and upgrade the account implementation without touching individual accounts. The same two-key design also has to survive a more ordinary event: users lose their phones.

What happens if a user loses their device?

A lost phone takes one key with it, and an Aligned account can hold up to 10. A passkey lives on one device and cannot be copied off it (unless the platform syncs it, as iCloud Keychain does), so users can enroll each new device in two steps: the new device registers a passkey, and a device that already holds a key approves it. The addition lands on-chain under the same 2-of-2 rule as any transaction.

If every device is gone, recovery runs through an optional guardian with a timelock. A key the guardian adds cannot sign until the timelock expires, and the wait is the security property: the real owner has time to cancel a recovery they did not start, from any device that still works.

Which products need embedded wallets?

Embedded wallets fit products built for mainstream users: neobanks, remittance and stablecoin payment rails, and digital identity systems. Their users cannot be expected to manage keys or buy gas.

Builders keep the user relationship. The wallet lives inside their own app and carries their own experience, while Aligned runs the signing backend beneath it. The trade-off is availability: both signers are required on every transaction, so a product depends on Aligned's backend being online to transact. Aligned was founded by the team behind LambdaClass, which has built core Ethereum and ZK infrastructure for more than five years.

Sovra already onboards citizens this way. Its government digital identity platform serves 8M+ citizens across Argentina, Mexico, and Colombia, and those citizens reach their identity through SovraWallet, built on Aligned Wallet-as-a-Service, with no seed phrases and no gas fees. Government identity is a demanding workload for a wallet, with uptime, cost, and data handling under serious public scrutiny. Aligned provides the rollup, wallet, and proving infrastructure behind SovraChain, Sovra's own ZK rollup that settles on Ethereum.

The wallet also arrives as part of a larger stack. Everything runs through a single integration for wallets, payments, and settlement, so a product that starts with an embedded wallet can later add its own ZK rollup that settles on Ethereum from the same team, with each user keeping the same address on every chain.

All of Ethereum behind a simple sign-in

Ethereum provides settlement and security that depend on no single company, and an embedded wallet puts those guarantees behind a familiar sign-in. Aligned Wallet-as-a-Service gives builders both: wallets their users open with a sign-in, and a custody rule their auditors can read on-chain.