---
title: "Verifying your smart account"
slug: "verifying-your-smart-account"
updated: 2025-09-11T04:38:15Z
published: 2025-09-11T04:38:15Z
canonical: "docs.stackup.fi/verifying-your-smart-account"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackup.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# Verifying your smart account

Stackup uses the onchain state of your smart account as the single source of truth. We recommend following this guide during wallet creation and all subsequent access updates to independently verify the state of your account matches expectations.

> [!NOTE]
> Techincal knowledge required
> 
> This guide is intended for technical users who are familiar with querying blockchain data and running scripts on a terminal.

## 1. Export your onchain configuration

All wallet’s onchain configuration can be exported via the Stackup dashboard under the wallet settings.

![](https://cdn.document360.io/dbfbaa96-255a-451a-bce5-b89923e769bb/Images/Documentation/Screenshot 2025-09-11 at 10.23.26 am.png)

Clicking the “copy” button will result in a JSON with the following data structure being copied to your clipboard.

```json
{
    "account": {
      "address": "0xC008B9B56a1a7C68E25A4873bEBBEC6D37359964"
    },
    "factory": {
      "address": "0x625cF8EDec3f68d48D3aA385F356524B04760BE8",
      "data": "0xd7eb8e818cf3485252207fa8de15de1377884c8bca5415e6dbdcce098f4a36496d9649e02b7c09135a0ff072be9241d3dcec4ac99e727c58d429c2f9f7eea1f01508fe66"
    },
    "entryPoint": {
      "address": "0x4337084D9E255Ff0702461CF8895CE9E3b5Ff108",
      "version": "0.8"
    },
    "keystore": {
      "address": "0x69C9F626b5Bd934C0F9806346682eD407FB978d3",
      "refHash": "0x8cf3485252207fa8de15de1377884c8bca5415e6dbdcce098f4a36496d9649e0",
      "latest": {
        "rootHash": "0xfef609a4f739ea279b309b41da8541424689b2374cc215e4f2a2f283ab61412c",
        "userConfigurationMerkleTree": [
          [
            "0xE19620169A26aEbC4Fe229A073639da6b009bF1a",
            "0x6f835026f13d3726dcea6946bf58487818b10e501135b5d6e532ebc884904818e92edde1d15c106e03f4e995c7c4e367228020db4b9828ffcb10b60c10b5d8cb"
          ],
          [
            "0x939C10DCdA11A73eCCc563340aBE3d257859dC6d",
            "0x000000000000000000000000e10980d4bbf1ce70e4767128577902fa3c126b86dbfd06ad5ec165db091035ef00bb60ea920c629ed64e4faf0dd68ca7c63c07e3b7904d1ceb578d498a6069d7b1e6574241af040e93465792f33cd16b9675b410"
          ],
          [
            "0x939C10DCdA11A73eCCc563340aBE3d257859dC6d",
            "0x000000000000000000000000e10980d4bbf1ce70e4767128577902fa3c126b86698621fc22457ceb7a17bb6d6e618ea7c9f0c29f93a3fc51c19c73b45ef6ca5b9a99111c035689a9f1c566b95c42c11629b02901896637e426d0c6fca25b4ce6"
          ]
        ]
      }
    }
  }
```

This might seems a intimidating at first, but lets walk through it.

## 2. Verifying your account address

Stackup smart accounts are built on v0.8 of the ERC-4337 EntryPoint. First thing we need to do is ensure we are using the canonical address. The `entryPoint.version` should be `0.8` and the `entryPoint.address` should be `0x4337084D9E255Ff0702461CF8895CE9E3b5Ff108` as defined in the [official release notes](https://github.com/eth-infinitism/account-abstraction/releases/tag/v0.8.0).

We also want to make sure that the smart account is being deployed from the canonical keystore account factory. The `factory.address` should be `0x625cF8EDec3f68d48D3aA385F356524B04760BE8` and the `factory.data` should be a concatenation of `0xd7eb8e81` (the function selector for `createAccount`), the 32 byte reference hash (more on this later), and a 32 byte salt.

Lastly, `account.address` is the address of your onchain smart account that is the same on all EVM blockchains. Rather than trusting this value, we can verify it quiet easily with independent tools like Tenderly.

![](https://cdn.document360.io/dbfbaa96-255a-451a-bce5-b89923e769bb/Images/Documentation/Screenshot 2025-09-11 at 11.01.18 am.png)

In the Tenderly simulator, we are making a call to `getSenderAddress` on the v0.8 EntryPoint and setting the `initCode` as the concatenation of the `factory.address` and `factory.data` from our JSON. By design, this call always reverts since it is intended for use during simulations only.

By parsing the `CALL` output or revert error data, we can see the deterministic sender address that is generated.

![](https://cdn.document360.io/dbfbaa96-255a-451a-bce5-b89923e769bb/Images/Documentation/Screenshot 2025-09-11 at 11.09.45 am.png)

**The sender address from the simulation should match your account address which gives strong guarantees that your smart account is in fact using the correct EntryPoint and factory.**

## 3. Verify your access configuration

The last thing we need to do is verify that your access controls are configured with the exact combination of signers you expected. This process also gives cryptographic guarantees that no malicious signers are hiding within your configuration.

First we need to make sure that `keystore.address` is pointing to the canonical keystore contract at `0x69C9F626b5Bd934C0F9806346682eD407FB978d3`. We can then use an independent tool like Etherscan along with the `keystore.refHash` and `account.address` value to get our current root hash.

![](https://cdn.document360.io/dbfbaa96-255a-451a-bce5-b89923e769bb/Images/Documentation/Screenshot 2025-09-11 at 11.24.01 am.png)

The returned root hash value should match exactly with the value in our JSON `keystore.latest.rootHash` field. This root hash represents a unique Merkel tree setup and is essential in proving if a signer does or does not belong to your smart account.

The actual Merkel tree configuration can be seen in our JSON `keystore.latest.userConfigurationMerkelTree` field. This data structure is organized as an array of nodes where each node is a tuple of the verifier address and associated configuration.

- `0xE19620169A26aEbC4Fe229A073639da6b009bF1a` refers to the WebAuthn verifier and the data is a passkey public key. These are used for admins.
- `0x939C10DCdA11A73eCCc563340aBE3d257859dC6d` refers to the WebAuthn + ECDSA cosign verifier where the data includes the passkey public key and the cosigner’s ECDSA address. These are used for restricted signers.

In order to prove that this access configuration is complete and accurate, we need to calculate the root hash of the Merkle tree and verify that it matches what we are seeing onchain. We can do this using a open source script from the [official keystore repository](https://github.com/stackup-wallet/keystore).

After cloning and installing the dependancies, open the file at `examples/verify-ucmt.ts`. Replace the current `USER_CONFIGURATION_MERKLE_TREE` with the value from our JSON.

![](https://cdn.document360.io/dbfbaa96-255a-451a-bce5-b89923e769bb/Images/Documentation/Screenshot 2025-09-11 at 11.42.13 am.png)

Save the file and run the following command in your terminal.

```shell
npm run examples:verify-ucmt
```

You should see the following output.

![](https://cdn.document360.io/dbfbaa96-255a-451a-bce5-b89923e769bb/Images/Documentation/Screenshot 2025-09-11 at 11.43.41 am.png)

We can see that the calculated UCMT root exactly matches what we have in our JSON and what we see onchain. **This is a strong cryptographic guarantee that your access configuration is shown in full and there are no malicious signers being hidden**.

## Smart account verification checklist

In summary, we can use the following steps to always verify that our Stackup smart accounts are non-custodial and configured as we intended.

1. Export onchain parameters from wallet settings.
2. Verify that v0.8 of the canonical EntryPoint is being used.
3. Verify that the canonical keystore factory is being used.
4. Run a `getSenderAddress` simulation on the EntryPoint with the factory address and data as the input.
5. Verify generated address matches the exported account address value.
6. Verify that the canonical keystore is being used.
7. Use the `refHash` and account address to query the keystore for the current root hash.
8. Verify that the onchain root hash matches the latest value in the JSON export.
9. Calculate the root hash of the latest `userConfigurationMerkelTree`.
10. Verify that calculated root hash matches the expected value in our JSON.

**This verification process can be quiet involved but is worth doing at least once to verify that your account is setup to be safe, secure, and non-custodial as you intended.**