ChronoVault brings the same two-factor authentication people already know from Google Authenticator to Web3 self-custody wallets, without giving up privacy or decentralization. Every transaction requires proving you have a valid TOTP code for the current timestamp, and the proof happens entirely in zero-knowledge, so the actual secret never touches the chain.

The interesting decision was how to prove that TOTP code without leaking it. Most existing TOTP-wallet designs precompute a bunch of future codes, hash them, and check against a Merkle tree, which means if someone gets access to the client, they can brute-force those pre-hashed values offline. ChronoVault instead runs the actual RFC 6238 TOTP algorithm inside a Circom circuit, so what gets proven on-chain is a real cryptographic proof of knowing the secret, not just a Merkle inclusion check. It's built on ERC-4337 account abstraction, so the check happens directly inside the wallet's own transaction validation logic instead of bolted on somewhere else.