COZ has released onesig, an open-source JavaScript library that derives a deterministic session wallet from a single owner signature, enabling developers to create agent wallets for autonomous on-chain operations without backend infrastructure.

The library is designed for developers building applications where an AI agent or automated system needs its own wallet to make transactions, but the developer does not want to build or manage infrastructure to support it. With onesig, a user signs once with their existing wallet, and the library generates a reusable agent wallet that can transact independently, with no backend, no wallet storage service, and no vendor dependency required.

The ~150-line library works on any EVM-compatible network, including Neo X. The same owner, app, and parameters always produce the same wallet address, meaning the wallet can be re-created on any device simply by re-signing the same message.

How it works

When a user connects their wallet and triggers onesig, they sign an app-namespaced message containing the app name, version, owner address, and consent text. The library hashes that signature via keccak256 to derive a secp256k1 private key, producing a standard externally owned account ready to sign transactions.

onesig ships with a React hook (useSessionWallet) that caches the derived wallet in the browser, along with Node.js and Next.js examples for quick integration.

Production use in WhisperDark

The pattern is already live in WhisperDark, the Neo X dungeon-crawler developed by Neo Global Development in collaboration with COZ. In WhisperDark, players sign once to generate an agent wallet that autonomously spends xGAS on in-game purchases, including weapons, armor, and supplies, via Ax402 micropayments, with no human intervention per transaction.

Security constraints

COZ positions onesig as a convenience hot wallet, not a vault, and is transparent about its tradeoffs. The signature effectively is the private key. Anyone who obtains the raw signature can derive and drain the wallet. The library is recommended for pocket-change amounts only.

onesig works exclusively with externally owned accounts that produce deterministic signatures (RFC 6979), including MetaMask, Ledger, and Rabby. It is not compatible with smart-contract wallets such as Safe or ERC-4337 accounts, and there is no on-chain revocation mechanism. Rotating to a new wallet requires bumping the version number and manually sweeping remaining funds.

The current release, v0.2.0, adds determinism verification that catches incompatible signers before they silently produce a different wallet. On first use, the React hook signs twice to confirm the derived wallet is consistent, and cache integrity checks recompute the address from stored keys to detect tampering.

Prior art and ecosystem context

The signature-to-key derivation pattern was proposed on ethresear.ch in 2023 as a hierarchical deterministic wallet derivation function, though the proposal never progressed to a formal EIP. Fluidkey uses a similar approach for stealth addresses in production. COZ has positioned onesig as a correct, well-documented implementation of a known pattern rather than a new invention.

For developers who need scoped, revocable, on-chain authority over a user’s account, EIP-7702 session keys or ERC-4337 account abstraction offer stronger security guarantees at higher complexity. onesig trades those guarantees for zero infrastructure and maximum portability.

The library is distributed under the MIT license and can be installed via GitHub. Further details can be found at the link below:
https://github.com/CityOfZion/onesig

Tags: , ,