WaaP vs embedded wallet services
“Embedded wallet” covers several different products. A hosted key service, a key-splitting provider, an MPC network, and a smart-account platform all ship under that name, and they do not share a trust model. The comparison below is by property, so it stays true whichever one a reader is holding.
The four questions worth asking
Ask these of any provider, including this one.
| Who can sign without the user? | Whoever holds enough key material to complete a signature. Read the architecture, not the marketing |
| Does the wallet work outside this app? | A wallet scoped to one application resets the user’s history every time they move |
| What happens when the user’s device is compromised? | If a key or a share lives on the device, malware gets it |
| What happens when the interface lies? | If the transaction is simulated client-side, a compromised frontend can show one thing and sign another |
How the properties compare
| Property | WaaP | Typical embedded wallet service |
|---|---|---|
| Key location | Generated in an attested TEE, never on the device | Varies. Often a provider-held key or a share on the device |
| Signing without the user | Not without passing the policy gate. In Squid Mode, not by any single party | Usually the provider can sign |
| Account scope | One account across applications | Usually scoped to the integrating app |
| Where policy is enforced | Server-side, before a signature exists | Varies. Often absent, or advisory |
| Transaction simulation | Server-side, so it does not depend on what the interface drew | Often client-side or absent |
| Cost to integrate | Free. Pricing above the free tier is not finalised | Usually per-MAU or per-signature |
What this does not claim
It is not a claim that every embedded wallet service is custodial. Several are genuinely non-custodial, and the good ones differ from each other more than the category name suggests.
The claim is narrower: the questions above have answers, and the answers should decide the choice. A provider that cannot answer “who can sign without the user” in one sentence is the signal.
Related
Last updated on