ERC 725 Identity Management: A Live Demo on Ethereum

The W3C has defined standards enabling public addresses to build independently verifiable Web 3 reputation from Web 2 and Web 3 apps using self-attestations and social attestations. Decentralized Identifiers (DIDs) are off-chain data backpacks that enable users to sign and control private data written about them. DIDs are globally unique, cryptographically verifiable, and allow key rotation for security. Verifiable Credentials (VCs) are signed, encrypted attestations containing any data type, non-transferable, tamper-evident, and revocable. VCs can be disclosed with user consent at any granularity. Unlike public blockchains, VCs give users control over information sharing and are free to create. DIDs and VCs enable cross-chain communication between any identifier types without bridges or gas fees.

Decentralized Identifiers (DIDs) are a W3C global standard that enables user-controlled identifiers similar to email addresses. Verifiable credentials are digitally signed statements about reality that can be held offline and never need to touch the blockchain. DIDs can interoperate with both new decentralized systems and existing centralized systems, allowing disparate trust systems to communicate when they agree on the same basis for conversation. The W3C standards process involves multiple entities with different goals working toward common objectives, including organizations like Microsoft, GS1, and Web3 companies. Each entity wants something different from the format—whether tracking vessels at sea or linking Ethereum and Solana accounts. The goal is to create interoperability so all systems can communicate, which requires defining common protocols and standards.

Decentralized identity relies on established standards: (1) OpenID Foundation develops specifications for verifiable credential issuance and presentation; (2) W3C maintains the verifiable credentials data model standardizing structure and claims format; (3) Decentralized Identity Foundation oversees decentralized identifiers and related technologies. Major implementations include Microsoft Entra Verified ID and DocuSign's Matter. These standards ensure interoperability, allowing verifiable credentials issued by one system to be verified by another, despite different underlying implementations.

Decentralized Identifiers (DIDs) are self-sovereign, decentralized digital identifiers that solve the limitations of traditional identifiers by being easy to create, persistent, resolvable, and cryptographically verifiable without depending on any centralized authority; they work through a system where each DID points to a DID document containing cryptographic keys and controller information stored in a distributed ledger or verifiable data registry, enabling applications like verifiable credentials, secure peer-to-peer communication, and product provenance tracking.

Verifiable Credentials (VC) is a W3C standard that defines how credentials can be issued, verified, and presented. It enables the creation of digital credentials that can be verified without relying on central authorities. The standard supports various use cases from educational credentials to government documents. Verifiable Credentials contain: (1) Subject information - who the credential is about; (2) Predicate information - what facts are being verified; (3) Proof - cryptographic evidence that the credential is valid; (4) Metadata - information about the credential's validity and revocation status. Decentralized Identifiers (DIDs) consist of two parts: (1) Authorization - how the user proves they control the identifier; (2) DID Document - a public record containing information about the identifier, including public keys and service endpoints.

Decentralized identity and reputation systems are essential primitives for blockchain applications that require trust, governance, and user verification; these systems can be implemented through three main architectures—trust graphs using PageRank algorithms, social collateral mechanisms, and attestations from trusted anchors—each addressing the challenge of preventing Sybil attacks while enabling civil-resistant, decentralized decision-making in applications like governance voting, lending, and security token compliance.

Decentralized identity enables tracking and limiting bad actors through transparent accountability mechanisms. Proof of clean hands verifies individuals aren't associated with sanctioned nations or criminal organizations using zero-knowledge identity proofs that complete KYC without revealing identity. This enables privacy-preserving compliance with sanctions while preventing illicit activities. The system allows encrypted data storage with conditions for decryption—such as law enforcement requests meeting specific criteria—balancing privacy with regulatory requirements. These mechanisms address real-world vulnerabilities like the Bybit hack, where blind signing exploits occurred, by making transaction histories visible and enabling post-hack analysis of fund movements.

Government paper trail approaches leverage existing KYC infrastructure for immediate international deployment but sacrifice privacy. Biometric identity systems (like India's Aadhaar) achieve massive scalability but face severe vulnerabilities: single registration authority compromise enables unlimited fake identities, and false positives/negatives undermine reliability. Social network/web of trust approaches offer philosophical appeal for decentralization but struggle with verifying negatives (proving you have no other identities) and require increasing privacy concessions at scale.

Proof of Humanity is an Ethereum-based protocol that creates a decentralized registry of verified real people by requiring video confirmation of humanity and identity verification from existing members, enabling truly democratic voting systems resistant to Sybil attacks where each vote carries equal weight regardless of token holdings or computational power, while also providing Universal Basic Income (UBI) tokens to verified members on an hourly basis.

Companies like Revolut currently outsource KYC (Know Your Customer) and AML (Anti-Money Laundering) checks to centralized providers. In a decentralized identity system, these providers would build the core infrastructure by adding people as they go through normal verification processes. There is a fundamental trade-off between privacy and accountability in identity systems. Complete privacy without any accountability means no one can verify who you are, which would make the system unusable. The solution is to have accountability within each relationship while maintaining privacy across relationships. Every entity has a relationship with itself, which serves as the foundation for all analytics. This self-relationship contains the quality ratings of your various attributes based on the other relationships you have. The quality of verification is dynamic and based on the relationships you have formed, with ratings automatically updated based on ongoing interactions and disputes.

Account abstraction, standardized through ERC-4337, enables smart contract wallets that provide programmable access to assets, solving key Ethereum user experience issues including the need for ETH balance for transactions, difficulty in batching transactions, and poor security where private keys act as single points of failure with no recovery options.

Account abstraction ecosystem integration involves multiple considerations: aggregation of signatures is complex and will be part of native account abstraction eventually, requiring modular implementation as separate EIPs. Bundlers in ERC-4337 are critical but not necessarily centralized when used with mempools; RP-7560 shifts bundlers to assistant roles, reducing centralization vectors. Different account abstraction solutions (ERC-4337, EIP-7702, RP-7560) can coexist peacefully during transition periods. Wallets like MetaMask should evolve to support account abstraction by managing smart contract wallets rather than just private keys, with newcomers recommended to deploy upgradable proxy smart contract wallets for future-proofing.

EIP-4337 introduces account abstraction by enabling smart contract wallets that offer custom signature schemes (including multi-sig and social recovery), multi-operation atomic transactions, and paymaster-based gas abstraction, all without requiring core Ethereum protocol changes. The architecture uses user operations (containing sender, nonce, signature, init code, and call data) that are validated and executed through an entry point contract with two loops: a validation loop that verifies signatures and nonces, and an execution loop that performs the requested actions.

ERC-4337 provides account abstraction for smart contract wallets, addressing the limitations of externally owned accounts (EOAs) controlled by single private keys. EOAs have single points of failure where losing the key means losing all assets. Smart contract wallets can implement multi-signature rules, but face challenges including gas payment requirements (since transactions must start from EOAs), the need for constant EOA funding, and separate gas payments for verification logic. ERC-4337 aims to streamline these processes, reduce gas costs, and make smart contract wallets as user-friendly as EOAs.