EIP-8130 separates two questions that wallets often compress into one signature check:
1. Which authenticator proved control?
2. What is the resulting actor allowed to do?
The declared authenticator verifies signature data and resolves an actor identity. The account’s on-chain keystore then checks that actor’s scope, expiry and policy before execution.
The critical scope rule is counterintuitive: 0x0000 is unrestricted administrator authority, not an empty permission set.
Restricted grants can cover sender actions, policy-managed sessions, nonce use, self-paid gas or third-party sponsorship. Sender and payer signatures use separate domains to reduce role-reuse attacks.
Actors can expire or be revoked, but removing an administrator does not automatically revoke actors that administrator added earlier. Those actors remain active until their own expiry or explicit removal.
The proposal is still Draft. Security conclusions must follow the actual implementation rather than the EIP label alone.
Full guide:
https://tokentoolhub.com/eip-8130-account-configuration/
#Ethereum #AccountAbstraction #SmartAccounts #Web3Security #blockchain