Arbitrum Stylus Mobile Native Authentication Grant Completes P-256 Smart Account: When Your FaceID Becomes Your Ethereum Wallet

The announcement appeared on the Arbitrum governance forum in September 2026 with the excitement of a development team that had just connected iOS FaceID to an Ethereum smart account and decided that the problem was not the cryptography—it was the fact that most users still typed seed phrases into their phones. The Stylus Mobile Native Authentication Grant has produced a working P-256 (secp256r1) smart account implementation with native iOS and Android SDKs, allowing users to sign Ethereum transactions using biometric authentication. The pitch was transformative: instead of managing private keys, users could rely on the same secure enclave that protects their photos and payments. The fine print raised a question about whether biometric signing would bring mainstream users to Ethereum or just create a new dependency on Apple's and Google's hardware security models.

That was the grant. Then came the question of whether a wallet secured by FaceID is self-custody or just custody with better marketing.

What the Stylus Mobile Native Authentication Grant Actually Built

The grant describes a biometric signing system with specific mechanics:

The Authentication Mechanics:

- P-256 curve: Uses secp256r1, the same elliptic curve as Apple's Secure Enclave and Android Keystore

- Biometric binding: Private key generated inside device secure enclave, never exposed to application layer

- Smart account: ERC-4337 compatible account abstraction wallet with P-256 signature validation

- Cross-platform: Native iOS SDK and Android SDK for integration into mobile apps

- Fallback: Recovery mechanism via traditional seed phrase if device is lost

The Stated Goals:

- Eliminate seed phrase management for mobile users

- Enable mainstream adoption through familiar biometric authentication

- Improve security by leveraging hardware-backed key storage

- Support ERC-4337 account abstraction for gasless transactions

- Reduce user onboarding friction for Ethereum mobile applications

The Technical Implementation:

- Stylus Rust contracts for P-256 signature verification on Arbitrum

- Native iOS SDK wrapping Secure Enclave APIs

- Native Android SDK wrapping Keystore and BiometricPrompt APIs

- Smart account factory for deploying biometric-controlled wallets

- Sample applications demonstrating transaction signing flows

The grant frames these as user experience improvements. They are also a mechanism for making Ethereum account security dependent on mobile operating system vendors.

Key Metrics at a Glance

The Proprietary Biometric Custody Score (BCS)

I've developed a framework to evaluate whether biometric smart accounts improve custody or create new centralization risks:

Formula: BCS = (Security Improvement × 0.3) + (User Experience Gain × 0.25) + (Self-Custody Preservation × 0.25) + (Vendor Independence × 0.2)

Stylus Mobile Authentication Assessment:

A score of 6.05 indicates that biometric smart accounts are a major UX improvement with real security benefits but notable tradeoffs in custody philosophy and platform dependence.

The Three Biometric Authentication Traps

Trap 1: The Self-Custody Illusion

Ethereum's ethos emphasizes self-custody: not your keys, not your coins. The biometric smart account claims to preserve self-custody because the user controls the device. But the user does not control the secure enclave. Apple and Google do. The Secure Enclave is a black-box hardware component running proprietary firmware. It can be updated by the vendor. It can be restricted by policy. It can be compromised by supply chain attacks that the user cannot detect. The user who thinks they have self-custody because they use FaceID has the same custody model as a user who trusts a custodial exchange: a third party controls the infrastructure that secures their keys. The difference is marketing, not mechanics.

Trap 2: The Platform Dependency

P-256 signing through Secure Enclave works on iOS and Android today. But what if Apple changes its Secure Enclave API in a future iOS update? What if Google restricts Keystore access for regulatory reasons? What if a government demands that Apple disable biometric signing for certain users? The system that works seamlessly today depends on vendor policies that can change without notice. A wallet architecture built on platform-specific hardware features is not portable, not future-proof, and not censorship-resistant. Ethereum was built to resist centralized control. A wallet that depends on Apple and Google reintroduces that control through the back door.

Trap 3: The Recovery Ambiguity

The grant includes a recovery mechanism: if the device is lost, the user can recover via a traditional seed phrase. This sounds reasonable. But it means the system has two security models: the biometric model for daily use and the seed phrase model for recovery. If users rely on biometrics for daily use, they may not properly secure their seed phrase backup. The convenience of FaceID becomes a reason to neglect backup security. When the device is lost and the user needs their seed phrase, they discover they never wrote it down because they thought FaceID was enough. The recovery mechanism that was supposed to provide safety becomes a failure point because the convenience of the primary mechanism discouraged backup diligence.

Competitive Landscape: Mobile Wallet Authentication

The landscape shows a spectrum from true self-custody (hardware wallets) to convenience-first solutions (Coinbase Wallet). Stylus biometric sits between them.

Scenario Analysis: Three Futures for Biometric Ethereum Accounts

Scenario A: Mainstream Adoption (35% probability)

• Biometric smart accounts become the default for mobile Ethereum users
• Major dApps integrate the SDKs
• Seed phrase management becomes a niche concern for power users
• Platform dependencies are accepted as a reasonable tradeoff
• Ethereum mobile user base grows significantly

Scenario B: Hybrid Ecosystem (45% probability)

• Biometric accounts gain traction among casual users
• Power users maintain traditional EOAs and hardware wallets
• A two-tier ecosystem emerges: biometric for convenience, traditional for large holdings
• Platform dependency concerns limit institutional adoption
• The technology succeeds without replacing traditional custody

Scenario C: Platform Restriction (20% probability)

• Apple or Google restricts secure enclave access for blockchain applications
• Regulatory pressure forces changes to biometric signing policies
• Users who relied on FaceID discover they cannot access their wallets
• The ecosystem retreats to hardware wallets and traditional EOAs
• Trust in mobile biometric custody is permanently damaged

The Bottom Line

The Arbitrum Stylus Mobile Native Authentication Grant is a sophisticated project from developers who understand that seed phrases are the biggest barrier to mainstream Ethereum adoption. The Biometric Custody Score is 6.05/10. Security improves dramatically. User experience is transformative. Self-custody preservation is weak. Vendor independence is compromised.

The three traps—self-custody illusion, platform dependency, and recovery ambiguity—are structural risks. They reflect the fundamental tension between making Ethereum accessible and preserving its decentralized values. The user who signs with FaceID is not experiencing the self-custody that Ethereum maximalists describe. They are experiencing a different custody model that trades autonomy for convenience.

The deeper question is whether Ethereum needs to compromise on self-custody to achieve mainstream adoption. The biometric smart account is not an evolution of self-custody. It is a departure from it. Whether that departure is worth making depends on whether the goal is to bring billions of users to Ethereum or to preserve the cypherpunk ideals that created it.

The grant deserves recognition for technical excellence. The P-256 integration with secure enclaves is well-executed. The SDKs are developer-friendly. The user experience is genuinely improved. But the architecture that enables this experience also creates dependencies that Ethereum was designed to eliminate. The user who signs with FaceID is not more sovereign. They are more comfortable. Those are different things.

TL;DR

• What: The Arbitrum Stylus grant has built P-256 (secp256r1) smart accounts using iOS Secure Enclave and Android Keystore, enabling Ethereum transaction signing via FaceID, TouchID, and fingerprint authentication
• The Score: Biometric Custody Score of 6.05/10—security (8/10) improves via hardware-backed keys; user experience (9/10) is transformative for mainstream adoption; self-custody preservation (4/10) is weak as keys reside in vendor-controlled secure enclaves; vendor independence (3/10) creates platform lock-in risks
• The Reality: Familiar biometric authentication but keys are controlled by Apple/Google secure enclave infrastructure, not the user
• Three Traps: Self-custody illusion (FaceID is not self-custody); platform dependency (iOS/Android APIs can change or be restricted); recovery ambiguity (users may neglect seed phrase backups due to biometric convenience)
• Outlook: Mainstream adoption (35%) with biometric becoming default; hybrid ecosystem (45%) with casual users on biometric and power users on traditional wallets; platform restriction (20%) from vendor policy changes or regulatory pressure

Sources

• Arbitrum Governance Forum - Stylus Grant Update - September 2026 completion announcement for mobile native authentication
• Apple Developer Documentation - Secure Enclave - Technical details on P-256 key generation and storage
• Android Developer - BiometricPrompt and Keystore - Google's hardware-backed key storage APIs
• ERC-4337: Account Abstraction - Underlying smart account standard for biometric wallets
• Arbitrum Stylus Documentation - How Rust contracts run on Arbitrum's Stylus platform
• Ethereum Research - Passkey and WebAuthn - Related research on biometric authentication for Ethereum
• The Block - Mobile Wallet Adoption - Industry analysis of mobile wallet UX and adoption barriers
• Messari - Account Abstraction Report - Analysis of ERC-4337 adoption and smart account growth

Zain Tran is TotesTek's Ethereum Ecosystem Columnist & Accountability Reporter. He writes about Ethereum, ETH, smart contracts, DeFi, Layer 2 networks, staking, validators, and the real-world consequences of technical and financial failure.