Non-Custodial Security: How AFIKA Keeps User Keys Off the Backend

Introduction

AFIKA is a fast, simple USDC transfer app. The name comes from the continent it serves; the product goal is to make cross-border digital-dollar transfers feel as easy as a banking app while keeping the security guarantees of self-custody.

"Non-custodial" sounds simple, but it imposes a hard engineering constraint: the backend must never be able to move user funds, not even by accident, not even with a compromised server. This article explains the architecture that delivers that guarantee.

The Threat Model

We designed against three adversaries:

Adversary	Goal	Mitigation
Remote attacker	Steal keys via network	Keys never leave the device
Compromised backend	Sign transactions	No backend key material exists
Lost/stolen device	Access funds	Biometric + PIN + session timeouts

The critical property: even if our servers were fully compromised, an attacker would have no keys to steal and no signing ability. There is nothing to extract.

On-Device Key Generation

Keys are generated inside the device's secure enclave via the standard library on each platform — Secure Enclave on iOS, Android Keystore on Android. The private key never crosses the JavaScript bridge as plaintext during normal operation.

// Concept — key material stays in the secure enclave
const enclave = new SecureEnclaveKey();
await enclave.generate();
const publicKey = await enclave.publicKey(); // safe to share
const signature = await enclave.sign(transactionHash);

We deliberately do not use a simple mnemonic stored in AsyncStorage. The enclave-bound key gives hardware-grade protection and integrates cleanly with biometric unlock.

Account Abstraction with ZeroDev

AFIKA uses ZeroDev for account abstraction. The user's wallet is a smart contract wallet (ERC-4337) whose owner is the on-device enclave key. This buys two things:

1. Gasless UX — a paymaster can sponsor fees, so users never touch gas.
2. Recovery — a guardian system allows key rotation without ever moving funds to a central vault.

Because the owner key is on-device, the smart contract wallet remains non-custodial even though the infrastructure that relays transactions is centralized.

Transfer Flow

A USDC transfer on AFIKA goes through five steps:

1. User selects a saved contact and amount.
2. The app converts fiat estimate to USDC using a live FX feed.
3. The enclave signs the transfer transaction.
4. The transaction is submitted to the ZeroDev bundler.
5. The app polls the chain for confirmation and updates balance.

async function transferUsdc({
  amount,
  recipient,
  sponsorGas = true,
}) {
  const tx = await wallet.prepareTransfer({ amount, recipient });
  const signed = await enclave.sign(tx.hash);
  const receipt = await bundler.sendUserOperation({
    ...tx,
    signature: signed,
    gasSponsorship: sponsorGas ? "paymaster" : "user",
  });
  return receipt;
}

The server only relays signed transactions; it never constructs or signs them.

Biometric Security

Every unlock and every transfer above a configurable threshold requires biometric re-authentication. We implement a short-lived session token in the enclave that expires after 60 seconds of inactivity, so a stolen unlocked phone cannot be drained hours later.

How the Backend Stays Non-Custodial

Three rules enforced by architecture, not policy:

1. No key material — no wallet private keys exist anywhere in server-side code or databases.
2. No signing keys — servers only have read-only node access and bundler credentials.
3. No secrets for funds — the only server-side secrets are for Firebase Auth and analytics, which cannot move value.

We also run a weekly rotation audit that checks for any residual signing capability in production environments.

Trade-Offs

Non-custodial security costs something in UX:

• No password reset. Lost keys mean lost access, mitigated by the guardian recovery flow.
• Onboarding friction. Users must set up biometrics before the first transfer.
• Support limitations. We can never "reset" a wallet on a user's behalf — and that is the point.

Conclusion

AFIKA's non-custodial model is not a feature flag; it is a structural decision that removes the most attractive target in fintech — the server-side key vault — from the attack surface entirely. If your product moves value, ask whether the architecture could move it without the user, because if it could, someone will eventually try.