How Recovery Works

SweepGuard uses cutting-edge Ethereum technology to recover funds from compromised wallets. Here's how it works under the hood.

The Problem

When a wallet is compromised, attackers typically deploy a "sweeper bot" — an automated script that:

• Monitors the compromised address 24/7


• Detects any new incoming funds or approvals


• Immediately drains funds to the attacker's wallet


• Often front-runs any recovery attempt

This creates a race condition: you need to move funds before the sweeper detects and front-runs you.

The SweepGuard Solution

Flashbots Private Transactions

Flashbots is a private transaction relay that bypasses Ethereum's public mempool. Here's why this matters:

Without Flashbots:


• You submit a recovery transaction


• It sits in the public mempool (visible to everyone)


• The sweeper bot sees it and submits a competing transaction


• The sweeper's transaction gets included first (higher gas)


• Your funds are drained before your TX confirms

With Flashbots:


• You submit a recovery transaction via Flashbots relay


• The transaction goes directly to block builders


• It's invisible in the public mempool


• The block is built with your transaction included


• Funds are safe before the sweeper even knows what happened

EIP-7702 Account Abstraction

EIP-7702, activated with the Pectra upgrade, allows regular wallets to temporarily gain smart contract capabilities. SweepGuard uses this to:

Batch Operations:
Instead of sending 10 separate transactions to move 10 tokens, EIP-7702 lets us bundle everything into a single atomic transaction. This means:


• Lower total gas cost


• All-or-nothing execution (no partial failures)


• Faster recovery

Gas Sponsorship:
If the compromised wallet has no ETH for gas, EIP-7702 allows a "paymaster" to sponsor the transaction. SweepGuard can pay the gas on your behalf and deduct it from recovered funds.

Custom Logic:
EIP-7702 enables custom execution logic, such as:


• Time-locked transfers (delay large moves for security)


• Spending limits (auto-sweep only above a threshold)


• Multi-sig requirements (require multiple confirmations)

Recovery Pipeline

Here's the step-by-step pipeline SweepGuard uses:

1. Discovery



• Scan the compromised address across 33+ chains


• Identify all assets: ETH, ERC-20s, NFTs, DeFi positions


• Check for pending transactions or approvals


• Identify the attacker's sweeper bot behavior

2. Strategy



• Determine optimal recovery method (Flashbots, EIP-7702, or both)


• Calculate gas costs and estimated recovery value


• Prioritize high-value assets first


• Plan for cross-chain recovery if needed

3. Execution



• Construct recovery transactions


• Sign with the compromised wallet's key


• Submit via Flashbots relay for privacy


• Monitor for block inclusion


• Retry with escalating gas if needed

4. Monitoring



• Track recovery transaction status


• Set up auto-sweep for any new incoming funds


• Send real-time alerts via Telegram/Discord


• Log all actions for audit trail

Security Considerations

What SweepGuard Can't Do



• Recover funds already sent to exchanges — those require legal action


• Break encryption — we need your private key or signing access


• Reverse confirmed transactions — blockchain is immutable


• Guarantee recovery — some funds may be unrecoverable

What SweepGuard Does Protect



• Mempool privacy — Flashbots prevents front-running


• Atomic execution — EIP-7702 ensures all-or-nothing


• Gas efficiency — batched operations minimize costs


• Speed — automated pipeline is faster than manual recovery