EOA vs Smart Contract Wallets: Web3 Wallet Types Explained

This section presents multi-signature (multi-sig) as the ultimate security solution for large bitcoin holdings. Multi-sig requires multiple signatures to move funds, with common configurations being 2-of-3 and 3-of-5. The speaker explains that with 2-of-3, three signers are required but only two signatures move funds, allowing geographic distribution of hardware wallets (e.g., one in Hawaii, one in Paris). This makes it extremely difficult for any single attacker to compromise funds. Multi-sig also provides recovery capabilities if one wallet is lost or stolen, as remaining signers can still access funds. The section details practical implementation: receiving bitcoin uses public addresses freely shared, while moving funds requires signing with hardware wallets. The Trezor Model T allows signing directly on the device screen, providing security even if the computer is infected.

Multi-sig wallets require multiple participants (5-15) with a threshold determining required signatures, distributing secrets across participants to prevent single-point compromise. Hardware wallets like CasTone 3 Pro store keys on secure chips, supporting three simultaneous wallets. Setup requires: hardware wallet with Bitcoin firmware, smartphone interface, and secure backup medium. For each participant: verify device, create wallet with PIN, name it, select standard Shamir phrase, use 12 words (128-bit entropy), and write seed phrases on paper in uppercase. To create multi-sig configuration: import extended keys (xpub) from each participant's hardware wallet, set threshold (e.g., '2 out of 3'). Import the configuration to each participant's device. To send funds: enter amount and recipient address, create transaction, export unsigned transaction as QR code. Each participant scans, signs with PIN, and the wallet displays signature QR code. After collecting required signatures, broadcast the transaction. Export to Sparrow desktop wallet for advanced management. Multi-sig wallets allow participants in different locations to sign transactions remotely via messaging apps. If a transaction is intercepted, only information is compromised, not funds—this is not fatal. The threshold system ensures no single participant can spend funds alone.

Multi-sig (multi-signature) wallets provide an alternative security model where funds can only be spent by signing with multiple different hardware devices. For example, a wallet might require signatures from 3 out of 5 devices to send funds, similar to a safe deposit box requiring two keys. This approach distributes trust across multiple devices, meaning if one device's randomness is compromised or if a user makes an error during entropy generation, the funds remain safe. Different hardware wallet providers use different entropy generation methods—Cold Card allows user-provided entropy while Ledger uses proprietary methods. Users must trade off the convenience of not rolling dice against trusting companies to follow proper entropy practices.

The WazirX hack revealed critical vulnerabilities in multi-sig wallet security. Despite requiring 3 out of 6 signatures, the attack succeeded because hackers exploited a phishing smart contract during a wallet upgrade, replacing legitimate code with malicious code. This gave hackers unauthorized access to the wallet. They then executed a data delegation call to an external contract, modifying the smart contract code within the wallet. The attack began 8 days before the main theft, with hackers sending small test transactions ($10 Shiba Inu, $29 USDT) to verify the system. The exchange team and Nomad signed these transactions, providing hackers with the credentials needed for the main attack.

Multi-signature wallets require multiple approvals (e.g., 2-of-3 or 3-of-5) to authorize transactions, substantially increasing security by distributing control among multiple parties. However, this requires backing up multiple seed phrases stored in separate locations. Passphrase extensions provide enhanced security for single-signature wallets by splitting secrets into base phrases and additional passphrases added during signing. These mechanisms represent trade-offs between security complexity and accessibility, with different approaches suited to varying risk tolerances and technical capabilities.

Smart contract security audits involve scanning code to identify vulnerabilities including vulnerable withdrawers, reentrancy risks, locked funds, source code verification issues, and unauthorized upgrade capabilities. The audit process produces a security score (96% in this case) indicating the contract's security level. Key vulnerabilities checked include: reentrancy attacks, approval vulnerabilities, owner abuse potential, blocking loops, wallet blacklisting, and ownership transfer risks. The audit ensures the contract cannot be exploited by malicious actors and that funds remain protected.

Smart contract security is paramount given irreversible blockchain transactions. The Parity multi-signature wallet incident ($300 million loss) demonstrates that even audited contracts contain severe vulnerabilities. Three critical vulnerability categories threaten contract integrity: owner removal vulnerabilities occur when the 'removeOwner' function lacks validation, allowing anyone to eliminate all contract owners and permanently lock funds; callback vulnerabilities arise when contracts call other contracts during transactions, potentially triggering infinite recursion loops that drain funds or cause stack overflows; array index underflows occur because Solidity uses unsigned integers for array indices, so decrementing zero wraps to large positive numbers, corrupting storage by accessing unintended memory locations. The Truffle testing framework enables systematic verification through JavaScript-based test scripts with deployment capabilities. Access control testing verifies that modifiers correctly restrict function access to authorized addresses only. Testing methodology uses promise chains with .then() for expected successes and .catch() blocks to handle expected failures, asserting that error messages confirm transactions were reverted rather than succeeding unexpectedly.

Smart contract auditing involves analyzing token contracts to detect potential scams by examining key indicators such as fake transactions, suspicious wallet distributions (where developers hold excessive percentages like 80-86%), honeypot mechanisms that allow purchases but prevent sales, and non-standard owner contracts that hide ownership information; these audits can be performed online using free tools like BSC Check and honeypot.is to identify red flags before investing.

Smart contract security is essential for protecting blockchain tokens and the broader crypto economy from vulnerable exploits. The Tornado Cash hack in May 2022 demonstrates why audits are critical - the DAO governance proposal to change smart contract code was not audited before implementation, allowing hackers to steal all funds. A comprehensive audit involves scope assessment, team allocation, code freeze, and cross-checking. Code review differs from audits: code review focuses on quality and architecture (faster, collaborative), while audits focus on identifying vulnerabilities (slower, hacker-like approach). Smart contracts can be safe in isolation but vulnerable when interacting with external contracts through composability. Best practices include using standardized interfaces like ERC20 and ERC721, limiting external contract capabilities, and implementing pausability for emergency situations. Crowdsourced audits provide opportunities for white hat hackers but have limitations compared to professional audits.

Pay Join is a transaction batching mechanism that combines transactions from multiple parties into single transactions, breaking the assumption that all inputs belong to the sender. This improves transaction throughput and reduces fees. Lightning Network is a Layer 2 protocol enabling fast, low-cost transactions using smart contracts rather than the main blockchain. The integration with Nostr (a social media protocol) creates social payment features called 'zaps,' representing emerging use cases for Lightning adoption.

Rollups are Layer 2 scaling solutions that batch multiple transactions together, calculate their results, and publish only the aggregated result (plus a proof of correctness) to Layer 1, rather than publishing each transaction individually. This dramatically reduces the amount of data stored on Layer 1. The analogy is sending 1000 emails to one person: instead of sending 1000 separate emails, you send one email with a summary of all 1000 messages plus a proof that the summary is accurate. This batching mechanism is the core innovation that enables Layer 2s to process many transactions efficiently while maintaining Layer 1 security guarantees.

Modern blockchain networks like Ethereum, Cardano, and others have moved away from providing simple transaction throughput numbers. Instead, they rely on Layer 2 solutions that batch multiple transactions together and process them in larger units (such as 10 megabytes per transaction). This approach allows for higher effective throughput while maintaining the security of the underlying Layer 1 chain.

Layer 2 scaling solutions like optimistic roll-ups enable significant UX improvements for decentralized applications. Optimistic roll-ups execute transactions optimistically, assuming validity unless proven invalid through fraud proofs. This approach combines scalability benefits with security—transactions are posted off-chain with minimal on-chain data, while fraud proofs maintain integrity. A demonstration showed 2,100 transactions saved users approximately 2,600 minutes of waiting time compared to base layer transactions. The system enables instant confirmation, batched transactions (approve and transfer together), and native account abstraction for complex multi-step operations. Fraud proofs can be submitted by anyone within a one-minute window, maintaining security while enabling fast finality.

Layer 2 scaling solutions are technologies built on top of Layer 1 blockchains to improve scalability, user experience, and reduce costs. Scale Network provides smart contract execution and file storage services, solving user experience problems for developers and end users. Chainlink enables externally connected smart contracts to be secure and reliable by addressing scalability, privacy, and connectivity issues. Celer Network enables internet-scale adoption by allowing developers to build real-time interactive applications with extremely low transaction costs. Layer 2 solutions face two layers of UX problems: the blockchain UX problem and the Layer 2 technology UX problem. The biggest challenge is hiding away not only the blockchain but also the Layer 2 technology on top of it. Solutions include using familiar concepts from existing internet applications, abstracting away complicated layers, and building seamless integrations with API wallets.