VeraKey

VeraKey is Hide-My-Email for wallets: one passkey, unlinkable on-chain identities on Arbitrum.

The problem: cross-app wallets turn one passkey into one global ID. Every passkey smart account we inspected stores or emits the passkey's public key on-chain, so every app a person uses can be tied to the same key.

What VeraKey does: every app gets its own USDG account and ID behind a single passkey, with payments, sign-in and recovery built in. Each approval is a zero-knowledge proof (Noir, UltraHonk) made in the browser, in about 2 seconds on desktop Chrome. The chain learns that the passkey approved exactly this action, but never sees the passkey's public key or signature: the account stores a per-app nullifier instead, so nothing on-chain links a person's accounts. Unlinkable, not anonymous: amounts and recipients stay public, and USDG's issuer can still freeze any account.

What is built, and where it runs:

• Per-app smart accounts in Rust on Arbitrum Stylus: per-payment and daily caps, a cap on first payments to new recipients, an instant freeze, timelocked changes, a guardian nobody can see, and optionally the browser's payment sheet. Deployed on Arbitrum Sepolia.

• Gasless USDG payments through a relayer that can only submit what the passkey approved and takes a capped fee. Proven end to end with real proofs on a local Arbitrum Nitro devnode. No payment has run on Arbitrum Sepolia yet: we are still waiting for test USDG there.

• Sign in with VeraKey, live on Arbitrum Sepolia: any https site signs people in through VeraKey's popup, gets its own ID for each person, and verifies a proof of every sign-in on its server.

• Disclosures: prove to an auditor that two accounts share a passkey, without revealing the key. The verifier is deployed on Arbitrum Sepolia.

• An ERC-7579 validator module for modular smart accounts such as Kernel and Nexus, tested as a module with real proofs, and deployed on Arbitrum Sepolia.

• @verakey/sdk on npm, documentation at verakey.mdloglabs.org/docs, and the app at verakey.mdloglabs.org.

Security: an internal audit found 1 high, 1 medium and 4 low-severity issues in the contracts; all are fixed and redeployed. The circuits and contracts have not had an independent audit, so VeraKey is testnet only.

Everything in the repository was built during the Buildathon, starting 23 September 2026 (see the public git history at github.com/veraKey/veraKey):

• Two Noir circuits, one for WebAuthn P-256 approvals and one for consent-to-link disclosures, with UltraHonk verifiers. Moving to bb 5.2.0's optimized verifier cut a payment from 4.17M to 1.07M gas.

• The Stylus account and factory in Rust, the relayer, and the ERC-7579 validator module in Solidity.

• The web app, a 31-page documentation site, Sign in with VeraKey (popup and SDK), and @verakey/sdk on npm (0.1.1).

• 75 end-to-end tests with real proofs on a Nitro devnode, and an internal audit whose 6 findings are all fixed and redeployed to Arbitrum Sepolia.

Before the Buildathon: only the first version of the landing page and its Vite/Express scaffold. Our earlier repo adiitsuu-ui/arbitrum-nexus is a separate project with no shared files.

Not raised; self-funded so far. We are applying for an Arbitrum grant to take VeraKey to Arbitrum One: an independent audit of the circuits and contracts, proving on phones, and developer access so other apps can run VeraKey accounts.