Skip to content
Back to skills

Base Account

ASecurity

ERC-4337 smart wallet integration — Sign in with Base, one-tap USDC payments, gas sponsorship via paymasters, sub accounts, and spend permissions across chains. Use when integrating Base Account, SIWB, Base Pay, or paymasters.

  • 9 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 10, 2026
developmenttypescriptgobashapifrontendbackendsecuritydocumentation

Works with

  • cli
  • api

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 11 files and shows the line behind each finding

Scanned September 10, 2026

npx -y skills add cyotee/indexedex --skill base-account --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Base Account?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Base Account
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/cyotee-base-account/badge)](https://www.skillsdirectory.com/skills/cyotee-base-account)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: base-account
description: ERC-4337 smart wallet integration — Sign in with Base, one-tap USDC payments, gas sponsorship via paymasters, sub accounts, and spend permissions across chains. Use when integrating Base Account, SIWB, Base Pay, or paymasters.
metadata:
  expanded_from: base/base-skills (build-on-base/references/base-account/)
---

# Base Account

Full Base Account documentation is under `references/`. Start with the overview, then load the topic you need.

## Contents

- [overview.md](references/overview.md) — Base Account overview
- [authentication.md](references/authentication.md) — Sign in with Base
- [payments.md](references/payments.md) — Base Pay / USDC payments
- [capabilities.md](references/capabilities.md) — Account capabilities
- [sub-accounts.md](references/sub-accounts.md) — Sub accounts
- [subscriptions.md](references/subscriptions.md) — Subscriptions
- [prolinks.md](references/prolinks.md) — Prolinks
- [troubleshooting.md](references/troubleshooting.md) — Troubleshooting

## Overview

# Building with Base Account

Base Account is an ERC-4337 smart wallet providing universal sign-on, one-tap USDC payments, and multi-chain support (Base, Arbitrum, Optimism, Zora, Polygon, BNB, Avalanche, Lordchain, Ethereum Mainnet).

## Quick Start

```bash
npm install @base-org/account @base-org/account-ui
```

```typescript
import { createBaseAccountSDK } from '@base-org/account';

const sdk = createBaseAccountSDK({
  appName: 'My App',
  appLogoUrl: 'https://example.com/logo.png',
  appChainIds: [8453], // Base Mainnet
});

const provider = sdk.getProvider();
```

## Feature References

Read the reference for the feature you're implementing:

| Feature | Reference | When to Read |
|---------|-----------|-------------|
| Sign in with Base | [authentication.md](authentication.md) | Wallet auth, SIWE, backend verification, SignInWithBaseButton, Wagmi/Privy setup |
| Base Pay | [payments.md](payments.md) | One-tap USDC payments, payerInfo, server-side verification, BasePayButton |
| Subscriptions | [subscriptions.md](subscriptions.md) | Recurring charges, spend permissions, CDP wallet setup, charge/revoke lifecycle |
| Sub Accounts | [sub-accounts.md](sub-accounts.md) | App-specific embedded wallets, key generation, funding |
| Capabilities | [capabilities.md](capabilities.md) | Batch transactions, gas sponsorship (paymasters), atomic execution, auxiliaryFunds, attribution |
| Prolinks | [prolinks.md](prolinks.md) | Shareable payment links, QR codes, encoded transaction URLs |
| Troubleshooting | [troubleshooting.md](troubleshooting.md) | Popup issues, gas usage, unsupported calls, migration, doc links |

## Critical Requirements

### Security

- **Track transaction IDs** to prevent replay attacks
- **Verify sender matches authenticated user** to prevent impersonation
- **Use a proxy** to protect Paymaster URLs from frontend exposure
- **Paymaster providers must be ERC-7677-compliant**
- **Never expose CDP credentials client-side** (subscription backend only)

### Popup Handling

- Generate nonces **before** user clicks "Sign in" to avoid popup blockers
- Use `Cross-Origin-Opener-Policy: same-origin-allow-popups`
- `same-origin` breaks the Base Account popup

### Base Pay

- Base Pay works independently from SIWB — no auth required for `pay()`
- `testnet` param in `getPaymentStatus()` must match `pay()` call
- Never disable actions based on onchain balance alone — check `auxiliaryFunds` capability

### Sub Accounts

- Call `wallet_addSubAccount` each session before use
- Ownership changes expected on new devices/browsers
- Only Coinbase Smart Wallet contracts supported for import

### Smart Wallets

- ERC-6492 wrapper enables signature verification before wallet deployment
- Viem's `verifyMessage`/`verifyTypedData` handle this automatically

## For Edge Cases and Latest API Changes

- **AI-optimized docs**: [docs.base.org/llms.txt](https://docs.base.org/llms.txt)
- **Full reference**: [docs.base.org/base-account](https://docs.base.org/base-account)

Files in this skill

  • SKILL.md4 KB
  • base-account.png938 B
  • catalog.json1.3 KB
  • references/authentication.md7.7 KB
  • references/capabilities.md8.1 KB
  • references/overview.md2.9 KB
  • references/payments.md7.6 KB
  • references/prolinks.md5.3 KB
  • references/sub-accounts.md6.3 KB
  • references/subscriptions.md8.1 KB
  • references/troubleshooting.md6.4 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.