ERC-4337 Account Abstraction: Complete Developer Guide 2026

Introduction: Why Account Abstraction Matters in 2026

ERC-4337 an Ethereum standard that enables account abstraction entirely at the smart contract layer, letting developers build wallets with features that were previously impossible on EOAs: gas sponsorship, social recovery, batched transactions, passkey signing, and programmable security policies.

Since going live on mainnet in March 2023, ERC-4337 has become the foundation of modern wallet UX. By April 2026, over 45 million smart wallets have been deployed across Ethereum and L2s, and the standard processes more than 12 million UserOperations per month. Every serious consumer-facing dApp now uses account abstraction to hide seed phrases, sponsor gas, and enable one-click onboarding.

This guide walks you through the complete developer journey: understanding the architecture, deploying your first smart wallet, submitting UserOperations through a Bundler, sponsoring gas with a Paymaster, and shipping to production on L2s.

The Four Components of ERC-4337

ERC-4337 introduces four actors that work together to process transactions. Understanding how they interact is the foundation of everything that follows.

Architecture Diagram: How a UserOperation Flows

Here is the lifecycle of a single ERC-4337 transaction, step by step:

1. User initiates action in a dApp (e.g., "Swap 100 USDC for ETH")
2. dApp constructs a UserOperation and asks the smart wallet to sign it
3. Wallet signs with passkey, seed phrase, or session key
4. Signed UserOperation is sent to a Bundler RPC via eth_sendUserOperation
5. Bundler validates: signature, nonce, gas, Paymaster acceptance
6. Bundler adds operation to its local mempool
7. Bundler batches 1–N operations and calls EntryPoint.handleOps() on-chain
8. EntryPoint validates again, calls Paymaster if present, then executes callData on the wallet
9. On success, the wallet emits events and returns control to the EntryPoint
10. User sees confirmation in the dApp

Setting Up Your Development Environment

Let's get hands-on. You'll need Node.js 20+, a wallet with testnet ETH on Sepolia, and an Alchemy or Pimlico API key.

mkdir aa-tutorial && cd aa-tutorial
npm init -y
npm install viem permissionless @rhinestone/module-sdk
npm install -D typescript @types/node tsx
npx tsc --init

We'll use permissionless.js — a lightweight TypeScript library built on viem that handles UserOperation construction, signing, and Bundler communication.

Deploying Your First Smart Wallet

Create a file called deploy-wallet.ts. This script will generate a new smart account and deploy it on first use (counterfactual deployment — the wallet has an address before it exists on-chain).

import { createPublicClient, http, parseEther } from 'viem';
import { sepolia } from 'viem/chains';
import { createSmartAccountClient } from 'permissionless';
import { toSimpleSmartAccount } from 'permissionless/accounts';
import { createPimlicoClient } from 'permissionless/clients/pimlico';
import { entryPoint07Address } from 'viem/account-abstraction';
import { privateKeyToAccount, generatePrivateKey } from 'viem/accounts';

const PIMLICO_API_KEY = process.env.PIMLICO_API_KEY!;

async function main() {
  const publicClient = createPublicClient({
    chain: sepolia,
    transport: http('https://sepolia.rpc.thirdweb.com'),
  });

  // Generate a new signer key (in production, use passkeys or secure storage)
  const signer = privateKeyToAccount(generatePrivateKey());

  // Create a SimpleAccount (the reference ERC-4337 wallet implementation)
  const account = await toSimpleSmartAccount({
    client: publicClient,
    owner: signer,
    entryPoint: { address: entryPoint07Address, version: '0.7' },
  });

  console.log('Smart wallet address:', account.address);
  console.log('Is deployed:', await account.isDeployed());
}

main();

Run it:

PIMLICO_API_KEY=your_key tsx deploy-wallet.ts

The wallet address is determined deterministically from the signer and factory contract, so it exists before any on-chain deployment. The wallet will be deployed automatically the first time you send a UserOperation.

Submitting Your First UserOperation

Now let's actually send a transaction from the smart wallet. We'll send 0.001 ETH to Vitalik's address as a test.

const pimlicoClient = createPimlicoClient({
  chain: sepolia,
  transport: http(`https://api.pimlico.io/v2/sepolia/rpc?apikey=${PIMLICO_API_KEY}`),
});

const smartAccountClient = createSmartAccountClient({
  account,
  chain: sepolia,
  bundlerTransport: http(`https://api.pimlico.io/v2/sepolia/rpc?apikey=${PIMLICO_API_KEY}`),
  userOperation: {
    estimateFeesPerGas: async () => (await pimlicoClient.getUserOperationGasPrice()).fast,
  },
});

const hash = await smartAccountClient.sendTransaction({
  to: '0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045',
  value: parseEther('0.001'),
  data: '0x',
});

console.log('UserOperation hash:', hash);

The sendTransaction call under the hood:

• Builds a UserOperation with the correct nonce and gas estimates
• Asks your account to sign it
• Submits it to the Pimlico Bundler via eth_sendUserOperation
• Waits for inclusion and returns the on-chain transaction hash

Adding Gas Sponsorship with a Paymaster

Gasless transactions are the killer feature of AA for consumer apps. With Pimlico's sponsorship Paymaster, you can pay gas for your users programmatically.

const paymasterClient = createPimlicoClient({
  chain: sepolia,
  transport: http(`https://api.pimlico.io/v2/sepolia/rpc?apikey=${PIMLICO_API_KEY}`),
});

const sponsoredClient = createSmartAccountClient({
  account,
  chain: sepolia,
  bundlerTransport: http(`https://api.pimlico.io/v2/sepolia/rpc?apikey=${PIMLICO_API_KEY}`),
  paymaster: paymasterClient,
  userOperation: {
    estimateFeesPerGas: async () => (await pimlicoClient.getUserOperationGasPrice()).fast,
  },
});

// This transaction costs the user zero gas — Pimlico sponsors it
const hash = await sponsoredClient.sendTransaction({
  to: '0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045',
  value: parseEther('0.001'),
});

In production, you'd configure sponsorship policies on the Paymaster provider's dashboard (Pimlico, Alchemy Gas Manager, Biconomy) to set spending limits, allowed contracts, and user allowlists.

Batching Multiple Actions into One UserOperation

Because smart wallets can execute arbitrary code, a single UserOperation can perform multiple actions atomically. This unlocks UX patterns that would require 3–5 separate transactions with a regular EOA.

Example: approve USDC and swap on Uniswap in one click.

const hash = await smartAccountClient.sendUserOperation({
  calls: [
    {
      to: USDC_ADDRESS,
      data: encodeFunctionData({
        abi: erc20Abi,
        functionName: 'approve',
        args: [UNISWAP_ROUTER, parseUnits('100', 6)],
      }),
    },
    {
      to: UNISWAP_ROUTER,
      data: encodeFunctionData({
        abi: uniswapRouterAbi,
        functionName: 'swapExactTokensForTokens',
        args: [parseUnits('100', 6), 0n, [USDC_ADDRESS, WETH_ADDRESS], account.address, deadline],
      }),
    },
  ],
});

Both calls execute in a single transaction. If either fails, the whole UserOperation reverts. This is atomicity at the wallet level, not just the contract level.

Session Keys: Granting Scoped Permissions

Session keys are the killer feature for Web3 gaming and AI agents. A session key is a temporary signer that the smart wallet authorizes for a limited scope — specific contracts, value caps, time windows, or function selectors.

Using the Rhinestone ModuleSDK:

import { getSessionKeyPluginInstallData } from '@rhinestone/module-sdk';

const sessionKey = privateKeyToAccount(generatePrivateKey());

const installOp = getSessionKeyPluginInstallData({
  signer: sessionKey.address,
  permissions: [{
    target: GAME_CONTRACT_ADDRESS,
    selector: '0xa9059cbb', // only allow the 'move' function
    valueLimit: parseEther('0.01'),
    validUntil: Math.floor(Date.now() / 1000) + 3600, // 1 hour
  }],
});

await smartAccountClient.sendUserOperation({ calls: [installOp] });

Now the game can submit transactions using the session key without prompting the user, up to the constraints you defined. When the session expires or hits its value cap, it stops working automatically.

Going to Production: Security Checklist

Before shipping an ERC-4337 integration to mainnet users, verify:

• Signature scheme audited — if you use a custom signer (passkey, multisig, MPC), it must be formally reviewed
• Paymaster rate-limits — prevent attackers from draining your sponsorship budget
• EntryPoint version locked — always use v0.7 (or v0.8 when it ships) and pin the exact address
• Bundler fallback — if Pimlico goes down, can you route to Alchemy or Stackup?
• Nonce management — for high-throughput dApps, use 2D nonces to parallelize operations
• Simulation before signing — never sign a UserOperation without running eth_estimateUserOperationGas first

ERC-4337 vs EIP-7702: What's Next

EIP-7702 is an upcoming upgrade that lets regular EOAs (like MetaMask accounts) temporarily delegate control to a smart contract for a single transaction. It complements ERC-4337 by giving existing users access to AA features without migrating wallets.

In 2026, most serious dApps will support both:

• ERC-4337 for new users and embedded wallets (passkey-first onboarding)
• EIP-7702 for existing MetaMask users who want to batch transactions or use Paymasters without migration

Conclusion

ERC-4337 turns Ethereum wallets into programmable smart contracts, unlocking the UX patterns that Web3 has needed for a decade. The standard is mature, the infrastructure is battle-tested, and the developer tooling (permissionless.js, Alchemy Account Kit, Biconomy SDK, ZeroDev) makes integration a weekend project rather than a research effort.

If you're building a consumer dApp in 2026, you should be using account abstraction. The alternative — asking new users to manage seed phrases, hold ETH for gas, and sign transactions one at a time — is no longer competitive.

Start with permissionless.js + Pimlico on Sepolia, ship a gasless onboarding flow, then add session keys for your most-used actions. Your conversion rates will thank you.

For deeper dives into the protocols you'll integrate with, read our guides on Layer-2 solutions, Ethereum staking, and smart contract development.