Automated zaps

With Rhinestone, you can build app-managed crosschain vault deposits and withdrawals for EOA users. The pattern uses a companion smart account owned by the user, operated by your app via scoped session keys. There are two execution modes:

Instant — the user transfers tokens to the companion account, and the app executes the intent immediately
Delayed / Automated — the user pre-approves tokens, and the app pulls and executes later (triggered by an event or schedule)

In both cases, intents are signed by a scoped session key — no additional user interaction is needed after the initial setup.

Companion Account

Each user gets a companion smart account owned solely by their EOA. The account has smart sessions enabled so your app can operate it via a session key.

import { RhinestoneSDK } from "@rhinestone/sdk";
import { toViewOnlyAccount } from "@rhinestone/sdk/utils";

const rhinestone = new RhinestoneSDK({
  endpointUrl: `${appBaseUrl}/api`,
});

// Read-only reference to the user's EOA (the sole owner)
const ownerAccount = toViewOnlyAccount(userEoaAddress);

const companionAccount = await rhinestone.createAccount({
  owners: {
    type: "ecdsa",
    accounts: [ownerAccount],
  },
  sessions: {
    enabled: true,
  },
});

Since the user’s EOA is the sole owner, the account is fully non-custodial. Your app can only perform actions authorized by the session key scope.

Session Key Setup

Define multi-chain sessions scoped to the vault contracts your app supports. The session key is controlled by your app’s service.

import { erc20Abi } from "viem";
import { arbitrum, optimism } from "viem/chains";
import { privateKeyToAccount } from "viem/accounts";

// Session key controlled by your app's service
const sessionOwnerAccount = privateKeyToAccount(appSessionKey);

const sessions = await Promise.all([
  rhinestone.createSession({
    chain: arbitrum,
    owners: {
      type: "ecdsa",
      accounts: [sessionOwnerAccount],
    },
    permissions: [
      {
        abi: vaultAbi,
        address: ARBITRUM_VAULT_ADDRESS,
        functions: { deposit: {} },
      },
      // Pulling USDC from the user and returning vault shares also flow
      // through this session — scope them too.
      {
        abi: erc20Abi,
        address: USDC_ADDRESS,
        functions: {
          // ...
        },
      },
      {
        abi: erc20Abi,
        address: ARBITRUM_VAULT_TOKEN_ADDRESS,
        functions: {
          // ...
        },
      },
    ],
  }),
  rhinestone.createSession({
    chain: optimism,
    owners: {
      type: "ecdsa",
      accounts: [sessionOwnerAccount],
    },
    permissions: [
      {
        abi: vaultAbi,
        address: OPTIMISM_VAULT_A_ADDRESS,
        functions: { deposit: {} },
      },
      {
        abi: vaultAbi,
        address: OPTIMISM_VAULT_B_ADDRESS,
        functions: { deposit: {} },
      },
      // Plus the ERC-20 permissions, as above.
    ],
  }),
]);

The user signs once to authorize all sessions across all chains:

const sessionDetails =
  await companionAccount.getSessionDetails(sessions);

const enableSignature =
  await companionAccount.signEnableSession(sessionDetails);

Persist the session credentials for your service to use later:

const sessionCredentials = {
  hashesAndChainIds: sessionDetails.hashesAndChainIds,
  enableSignature,
};

Sessions can be further scoped to specific contract functions (e.g., deposit and withdraw) and guarded with policies like spending limits or timeframes. See the Smart Sessions docs.

Instant Execution

In the instant flow, the user makes a single token transfer and your app handles the rest.

Funding the Account

Prompt the user to transfer tokens to the companion account:

import { erc20Abi } from "viem";
import { writeContract, waitForTransactionReceipt } from "@wagmi/core";

const hash = await writeContract(wagmiConfig, {
  address: usdcAddress,
  abi: erc20Abi,
  functionName: "transfer",
  args: [companionAccount.address, depositAmount],
});

await waitForTransactionReceipt(wagmiConfig, { hash });

For native token deposits (e.g., ETH), transfer the native token directly to the companion account. The intent system handles wrapping to WETH internally.

Executing the Intent

Once funded, the companion account executes the crosschain intent using the session key:

import { encodeFunctionData, erc20Abi } from "viem";

// USDC on Arbitrum — token inputs are addresses, not symbols
const usdc = "0xaf88d065e77c8cC2239327C5EDb3A432268e5831";

const prepared = await companionAccount.prepareTransaction({
  sourceChains: [ethereum],
  targetChain: arbitrum,
  calls: [
    {
      to: VAULT_ADDRESS,
      data: encodeFunctionData({
        abi: vaultAbi,
        functionName: "deposit",
        args: [depositAmount],
      }),
    },
    // Transfer vault shares back to the user's EOA
    {
      to: VAULT_TOKEN_ADDRESS,
      data: encodeFunctionData({
        abi: erc20Abi,
        functionName: "transfer",
        args: [userEoaAddress, receiptTokenAmount],
      }),
    },
  ],
  tokenRequests: [
    {
      address: usdc,
      amount: depositAmount,
    },
  ],
  signers: {
    type: "session",
    session: sessions[0],
    enableData: {
      userSignature: enableSignature,
      hashesAndChainIds: sessionDetails.hashesAndChainIds,
      sessionIndex: 0,
    },
  },
});
const signed = await companionAccount.signTransaction(prepared);
await companionAccount.submitTransaction(signed);

After submitting the intent, poll the intent status until it reaches a terminal state (COMPLETED, FILLED, FAILED, or EXPIRED). This typically takes a few seconds for cross-chain settlements.

Delayed / Automated Execution

In the delayed flow, the user pre-approves tokens and your app triggers execution later — for example, on a schedule, when a vault matures, or in response to an onchain event.

Step 1: User Approves Tokens

The user approves the companion account to spend their tokens:

const hash = await writeContract(wagmiConfig, {
  address: usdcAddress,
  abi: erc20Abi,
  functionName: "approve",
  args: [companionAccount.address, depositAmount],
});

Step 2: Pull Funds and Execute

When your app is ready to execute, it pulls the funds from the user and executes the intent in two steps. Pull approved tokens into the companion account (same-chain):

const preparedPull = await companionAccount.prepareTransaction({
  targetChain: ethereum,
  calls: [
    {
      to: USDC_ADDRESS,
      data: encodeFunctionData({
        abi: erc20Abi,
        functionName: "transferFrom",
        args: [userEoaAddress, companionAccount.address, depositAmount],
      }),
    },
  ],
  signers: {
    type: "session",
    session: vaultSession,
    enableData: sessionEnableData,
  },
});
const signedPull = await companionAccount.signTransaction(preparedPull);
await companionAccount.submitTransaction(signedPull);

Execute the crosschain intent (bridge + vault deposit):

// USDC on Arbitrum — token inputs are addresses, not symbols
const usdc = "0xaf88d065e77c8cC2239327C5EDb3A432268e5831";

const preparedExecute = await companionAccount.prepareTransaction({
  sourceChains: [ethereum],
  targetChain: arbitrum,
  calls: [
    {
      to: VAULT_ADDRESS,
      data: encodeFunctionData({
        abi: vaultAbi,
        functionName: "deposit",
        args: [depositAmount],
      }),
    },
    {
      to: VAULT_TOKEN_ADDRESS,
      data: encodeFunctionData({
        abi: erc20Abi,
        functionName: "transfer",
        args: [userEoaAddress, receiptTokenAmount],
      }),
    },
  ],
  tokenRequests: [
    {
      address: usdc,
      amount: depositAmount,
    },
  ],
  signers: {
    type: "session",
    session: vaultSession,
    enableData: sessionEnableData,
  },
});
const signedExecute = await companionAccount.signTransaction(preparedExecute);
await companionAccount.submitTransaction(signedExecute);

This two-step flow can potentially be simplified to a single step using source chain executions.

Gas Sponsorship

You can sponsor the gas and bridging costs for the intent execution by passing sponsored: true:

// USDC on Arbitrum — token inputs are addresses, not symbols
const usdc = "0xaf88d065e77c8cC2239327C5EDb3A432268e5831";

const data = await companionAccount.prepareTransaction({
  sourceChains: [ethereum],
  targetChain: arbitrum,
  calls: vaultDepositCalls,
  tokenRequests: [{ address: usdc, amount: depositAmount }],
  sponsored: true,
  signers: sessionSigners,
});

The user still needs gas for the initial token transfer (instant flow) or approval transaction (delayed flow).

See the Gas Sponsorship docs for setup details.

Event Listening Service

For the delayed execution flow, your app implements a service that listens for onchain or offchain events to trigger executions. The service has access to the session key and stored credentials.

The specific events to listen for (e.g., ERC-20 Transfer events, vault maturity events, or offchain triggers) and the service architecture are implementation-specific.

Recovery

Funds are always non-custodial — the user’s EOA is the sole owner of the companion account. If a deposit fails mid-flow (e.g., the app goes offline after funding), the user can always sign a withdrawal transaction directly using their wallet. Persist the app’s session key so you can retry failed intents without requiring the user to re-approve.

Tutorial

Sending intents

Use cases

API guides

Configuration

Companion Account

Session Key Setup

Instant Execution

Funding the Account

Executing the Intent

Delayed / Automated Execution

Step 1: User Approves Tokens

Step 2: Pull Funds and Execute

Gas Sponsorship

Event Listening Service

Recovery

​Companion Account

​Session Key Setup

​Instant Execution

​Funding the Account

​Executing the Intent

​Delayed / Automated Execution

​Step 1: User Approves Tokens

​Step 2: Pull Funds and Execute

​Gas Sponsorship

​Event Listening Service

​Recovery

Companion Account

Session Key Setup

Instant Execution

Funding the Account

Executing the Intent

Delayed / Automated Execution

Step 1: User Approves Tokens

Step 2: Pull Funds and Execute

Gas Sponsorship

Event Listening Service

Recovery