Candide in 2026: Smart Accounts, Voltaire Bundler and No Confirmed Rewards

Candide is easy to misread if it is approached as another wallet app or as a speculative “early protocol.” Its current business is smart-wallet infrastructure: software and hosted services that let developers create user-controlled accounts, relay ERC-4337 operations, sponsor gas, add recovery, and simplify multichain deposits. The practical opportunity is to build with those tools—not to perform transactions in expectation of a token.

That distinction matters. Candide’s official website and documentation describe products, usage limits, fees, contracts, audits, and developer integrations. They do not announce a Candide token, points program, eligibility snapshot, or user airdrop. Using a public endpoint or a testnet can teach account abstraction, but it should not be represented as reward farming.

What Candide actually offers

The core stack combines smart-account infrastructure with hosted transaction services. AbstractionKit is its open-source TypeScript SDK. Voltaire is the ERC-4337 bundler implementation. InstaGas is the paymaster and policy layer. Candide also documents Safe account recovery, passkey authentication, multisig, scoped permissions, EIP-7702 upgrades, and a Safe Unified Account design for signing actions across multiple EVM chains.

These pieces serve different jobs. A smart account holds assets and enforces authorization. A bundler gets its operations onchain. A paymaster decides whether another party will cover gas or whether the user can pay the cost in a supported ERC-20. The SDK helps an application assemble and coordinate those components, but it is deliberately compatible with third-party bundlers and paymasters.

The broader product line now includes Forwarding Address, which gives a recipient one deterministic deposit address and routes supported deposits from selected source chains to a destination chain. It also includes OpenSig, a separate mobile verification tool for pending Safe multisig transactions. OpenSig simulates consequences and provides an isolated verification channel; it is not a wallet, bundler, or rewards product.

ERC-4337 in the Candide transaction path

ERC-4337 adds smart-account behavior without requiring a base-layer protocol change. Instead of broadcasting a normal EOA transaction directly, the application constructs a UserOperation. That object carries the sender, nonce, call data, gas fields, and account signature. A bundler validates pending operations and submits one or more of them to the network’s EntryPoint contract.

The EntryPoint verifies the account’s rules and the proposed gas payment before executing the requested call data. An optional paymaster can supply the gas commitment. This is what makes a “gasless” transaction possible from the user’s perspective: gas still exists and someone still pays it, but the application sponsor pays instead of requiring the user to hold the chain’s native token.

Candide supports both newly created contract accounts and EIP-7702 flows. For a new wallet, its current SDK guidance recommends SafeMultiChainSigAccountV1 with EntryPoint v0.9. For an existing EOA that must keep the same address, it recommends Simple7702AccountV09. EIP-7702 lets that EOA authorize smart-account code at its address, but the original private key retains administrative power. It therefore improves capability without erasing the original EOA security model.

What Voltaire does—and what it does not do

Voltaire is Candide’s open-source Python bundler. It receives UserOperations, simulates and validates them, keeps eligible operations in a mempool, estimates gas, and submits bundles to the EntryPoint. Candide offers hosted public and authenticated endpoints, while developers can also run Voltaire themselves from its published Docker image and source.

A bundler is not a custodian. It does not receive the account’s owner key, and it cannot rewrite a properly signed UserOperation into an arbitrary transfer. It can nevertheless affect availability and timing: it may reject malformed or underpriced operations, fail during an RPC outage, hit capacity limits, or choose not to include an operation. Submission is not confirmation. Applications should wait for an onchain receipt and inspect its success field.

Self-hosting changes the operational trust boundary, not the blockchain rules. A production Voltaire instance needs a funded bundler signer, reliable full-node access, monitoring, fee logic, and protection of its secret. Candide’s installation guide warns that full ERC-4337 storage and opcode checks require a node that supports debug_traceCall with the required tracer. The --unsafe mode skips those checks and is explicitly unsuitable for production.

AbstractionKit, passkeys, recovery, and wallet controls

AbstractionKit builds and sends UserOperations with support for Safe accounts, Calibur accounts, and Simple EIP-7702 accounts. It can batch calls, estimate gas, connect to bundlers, request paymaster data, and format signatures. The documentation tracks version 0.4.0 and says the library is agnostic to ethers, viem, web3.js, the chosen bundler, and the chosen paymaster.

Authentication is programmable. A Safe can use ordinary Ethereum addresses, multisig thresholds, or WebAuthn passkeys. Passkeys place signing behind the device’s biometric or PIN flow and bind credentials to a relying-party domain. They reduce seed-phrase friction, but they introduce device, browser, domain, and credential-recovery dependencies. Candide specifically warns developers not to ship a production 1-of-1 passkey-only Safe without a second access method.

The social recovery module lets chosen guardians approve replacement of a lost owner key, followed by a grace period during which the current owner can cancel an unauthorized recovery. Guardians may be personal wallets, hardware wallets, institutions, or managed email/SMS services. If Candide Guardian is used for email or SMS, Candide becomes a trusted guardian service that verifies the challenge and supplies a guardian signature. A threshold such as two of three avoids making that service the sole recovery authority.

Paymasters turn gas into a product decision

InstaGas lets an application fund gas policies and define which operations qualify. Rules can limit total sponsored value, cost per UserOperation, frequency per account, eligible sender addresses, web origins, IP addresses, destination contracts, function selectors, and decoded parameters. Transaction rules match an exact ordered list of calls, which is useful for sponsoring a specific approve-and-deposit batch rather than every call to a contract.

AbstractionKit offers the Candide-specific paymaster client and the standard Erc7677Paymaster. Candide recommends the ERC-7677 client for new one-shot sponsorship and token-gas integrations because it is portable across providers. The Candide client remains useful for provider-specific APIs and the EntryPoint v0.9 commit-sign-finalize flow.

Token payment is different from sponsorship. With sponsorship, the app pays network gas from its policy balance. With token gas, the user pays an ERC-20 amount quoted by the paymaster instead of holding ETH or the chain’s native asset. Supported tokens vary by network and API key, so an integration should query pm_supportedERC20Tokens rather than hardcode assumptions. Candide also documents a Solana paymaster based on Kora that can pay the network fee and collect USDT.

A practical integration path

1. Choose the account model. Create a new Safe smart account when a new address is acceptable, or use an audited EIP-7702 implementation when an existing EOA address must remain. Decide the signer and recovery model before receiving funds.
2. Install the SDK and start on testnet. Install abstractionkit, configure a node RPC, and use Candide’s Sepolia public endpoint or an authenticated project endpoint. Public endpoints require no API key but are IP rate-limited.
3. Construct calls and the UserOperation. Define each target, value, and encoded call data. Let the account class fetch the nonce and gas data and ask the bundler to estimate limits. A new Safe address can be calculated before deployment; its contract is normally deployed with the first operation.
4. Apply the gas model. Request sponsorship under a tightly scoped policy, request an ERC-20 gas quote, or fund gas normally. Treat a policy ID and the full authenticated endpoint URL as secrets where practical. A team management key must never be shipped in frontend code.
5. Sign, submit, and verify. Present the actual batched effect to the user, obtain the required signatures, submit to the bundler, and wait for inclusion. Record both the UserOperation hash and final transaction hash, and distinguish “included but reverted” from success.

For higher-risk actions, simulation is part of the product, not merely a debugging convenience. Candide documents Tenderly simulation helpers, while OpenSig addresses independent verification for pending Safe multisig transactions.

Costs and limits are more than network gas

Candide’s pricing page separates infrastructure usage from gas. Starter is free and includes 2,500 mainnet UserOperations in total, 25,000 API requests, two mainnet chains, and unlimited testnet use. Its sponsored-operation allowance is 1,000 in total. After the Starter mainnet allowance is consumed, mainnet access pauses until the project upgrades; testnet remains available.

Launch is $399 month-to-month or an effective $333 per month when billed annually. It includes 100,000 UserOperations and 5,000 sponsored operations per month; additional sponsored operations cost $0.01 each before gas. Grow is $899 month-to-month or an effective $749 per month annually, with 500,000 UserOperations, 25,000 included sponsored operations, and a $0.005 fee for each additional sponsored operation. Enterprise starts at $3,000 per month and offers contract-defined volume, dedicated infrastructure, and a 99.9% SLA.

Gas is passed through at network cost rather than marked up, but that does not make transactions free. The sponsor funds every sponsored operation, and Ethereum gas spikes still increase the sponsor’s bill. ERC-20 gas payment also has a token cost. Forwarding Address is priced separately per transaction; its API returns route fees and estimated recipient output before deposit. Account Recovery Service pricing is available on request.

Trust assumptions, failure modes, and security boundaries

Candide states that user funds and keys do not touch its hosted infrastructure. That is an important custody distinction, but it does not mean every workflow is trustless or failure-proof. A hosted bundler and paymaster are availability dependencies. Node providers supply chain state. A managed email/SMS guardian participates in recovery authorization. Forwarding Address uses relayers and external route mechanisms, even though its source-chain contracts restrict who can withdraw.

Failure handling must be designed in. A paymaster can refuse a request because no policy matches, its budget is depleted, a rate cap is reached, or calldata differs from the exact rule sequence. Authenticated endpoints can return Too Many Requests at plan or throughput limits. A WebAuthn signature can fail because the relying-party domain changed. A multisig can become unusable if its threshold exceeds the remaining accessible keys.

Forwarding Address adds route-specific risks: monitoring has a TTL; unsupported tokens and below-minimum deposits are not automatically forwarded; a paused policy or insufficient sponsorship balance can leave funds waiting; and there is currently no completion webhook. The recipient can recover from the source-chain contract immediately, while a configured company recovery wallet can do so after a timelock. Choosing that recovery wallet creates a real operational trust role and should not be hidden from users.

Smart-contract assurance is also component-specific. Candide links audits and formal verification for its recovery contracts, Safe code and modules, and a Nethermind audit for the multichain signature module. That evidence reduces uncertainty; it does not guarantee the integrating app’s calldata, upgrade choices, signer storage, frontend, policies, or third-party contracts. Teams should pin reviewed versions, verify deployment addresses against the official technical reference, simulate sensitive calls, protect API and bundler keys, and maintain an alternate ERC-4337 provider or self-hosted path for critical flows.

No confirmed rewards—and how fake claims could target Candide users

There is no official basis for calling Candide usage an airdrop strategy. The official materials reviewed for this article do not publish a Candide token, points balance, season, snapshot, claim contract, or retroactive allocation. The Sepolia faucet token shown in developer examples is test infrastructure, not evidence of a future asset. Likewise, “sponsored” UserOperations are gas paid by an app or policy; they are not rewards paid to the wallet user.

This project’s terminology gives scammers useful camouflage. A fake site may promise points for sending UserOperations through Voltaire, ask users to “activate” a Safe for eligibility, or present a malicious signature as an EIP-7702 upgrade. Another may impersonate account recovery and request an owner change, guardian approval, OTP, or seed phrase. A counterfeit paymaster page could request an unlimited token approval while claiming it is needed for gasless transactions.

Use only links reached through candide.dev or docs.candide.dev, and treat the exact destination chain, account implementation, owner change, token approval, and batched calls as the security decision. Candide’s real infrastructure never turns an unexplained claim signature into a safe action. Until Candide itself publishes verifiable reward terms, “Candide airdrop,” “Voltaire points,” and urgent claim links should be treated as unconfirmed at best and phishing at worst.

Frequently asked questions

Does Candide have a confirmed token or airdrop?

No confirmed Candide token, points program, snapshot, or airdrop appears in the official website and documentation reviewed for this article. Product usage should be evaluated for its utility and cost, not assumed future rewards.

Is a Candide smart account self-custodial?

The supported account contracts can be user-controlled, and Candide says it does not hold user keys or funds. Control still depends on the selected owners, threshold, plugins, recovery guardians, and any delegated permissions. A managed email/SMS guardian introduces a service dependency for its share of recovery authorization.

Can an application leave Candide without moving user accounts?

ERC-4337 accounts and AbstractionKit are designed around open standards, and the SDK can use other compliant bundlers and paymasters. In practice, migration still requires replacing endpoints, testing provider behavior, preserving policy logic, and ensuring the chosen account and EntryPoint versions are supported.

What does “gasless” mean here?

It means the user does not pay native gas directly. An application sponsor may pay through a paymaster, or the user may settle the cost in a supported ERC-20. Network gas is still incurred, and sponsorship can stop when policy rules, budgets, or limits are not satisfied.