Carte Bleue

Carte Bleue lets users recover a smart contract wallet using a physical bank card instead of a seed phrase or other unsecure methods. A local Python server communicates with the card reader, extracts the card’s RSA public key, and asks the card to sign a random challenge. A smart contract on Base verifies that signature and changes the wallet owner to a new address. The private key never leaves the card, and sensitive payment details such as the card number or expiration date are never stored on-chain.

Please note that the project purposefully has no live demo as this is something you can only run on your own machine as you need a local Python server that will securely read your credit card. Instructions on how to run are on GitHub.

Fun fact: "Carte Bleue" was a credit card network competing with Mastercard/Visa developed in France, but got discontinued in 2010, the name is a small reference to it, repurposing it for secure wallet backups.

Carte Bleue combines a local Python/FastAPI server, PC/SC card-reader access, an ethers.js frontend, MetaMask, and Solidity contracts on Base. The server sends raw EMV APDU commands to a CB bank card, reconstructs its 1408-bit RSA public key from the EMV certificate chain, and requests signatures through INTERNAL AUTHENTICATE. The frontend registers that public key for a SimpleWallet (smart contract wallet), then submits signed recovery challenges to Carte Bleue. The notable hack was implementing custom on-chain RSA verification with the EVM modexp precompile because standard libraries reject the card’s unusual 1408-bit key size.