Business accounts on OpenZeppelin smart accounts
Problem
A personal wallet has one signer, so whoever holds the phone controls the money. A business is several people. It needs shared access with different powers, staff who can buy cover but not move money out, and a way to remove someone the moment they leave.
Stellar classic accounts have native multisig, but signers are ed25519 keys and thresholds apply per operation category, so "may buy cover but may not withdraw" cannot be expressed: every contract call falls in the same category.
Approach
- Each business is its own Soroban smart account running OpenZeppelin's stellar-accounts 0.8.0, separate from every member's personal wallet.
- Members sign with their own passkey. Their role decides which of the account's context rules their passkey is a signer on:
| Role | Context rule | Policies |
|---|---|---|
| Admin | Default (any call) | OpenZeppelin threshold policy, 1 approval |
| Operator | CallContract(currency pool), CallContract(rate pool) | Threshold policy, 1 approval |
| Operator | CallContract(USDC) | BlockFinaX transfer allow-list: transfer from the account to a listed pool only |
| Viewer | None |
- Buying cover authorises two contexts: the pool call and the USDC premium transfer inside it. An operator claims the pool rule and the USDC rule; the allow-list refuses any other recipient,
approve, or any other token function. - Spend limits and two-admin approval are OpenZeppelin policies (spending limit, threshold) that an admin can switch on for a business with one transaction. No new contract is needed.
Why
- OpenZeppelin's model (context rules, signers, policies) maps directly onto the roles, so BlockFinaX writes one small policy instead of an account contract.
- The account and its policies are maintained by OpenZeppelin, and Stellar documents this account alongside Passkey Kit as one of its two smart wallet options.
- Business accounts are new accounts, so adopting a different account contract for them needs no migration of existing wallets, balances or contracts.
Trade-offs
- Two wallet types. Personal wallets stay on Passkey Kit while business accounts run on OpenZeppelin, so the app supports both.
- One extra contract. The transfer allow-list policy is BlockFinaX code. It has no admin and no upgrade function: a change means deploying a new policy and moving rules to it.
- Stellar only. Business accounts live on the liquidity hub. Funding from other networks, and Request a quote, work from personal accounts for now.