Ethereum Delegations Reveal Widespread Use of Malicious Contracts

The Ethereum address of anyone who has undergone the Pectra upgrade can execute someone else's program code without changing their address, balance, or key. This is made possible by EIP-7702, which allows an ordinary account to run a contract's code with just one signature from the account owner.

This feature, known as delegation, has been touted as convenient for wallet users and providers, but it also poses a risk if not used carefully. An attacker can use a drained account's delegated authority to keep control of it permanently.

A recent analysis by cryptoticker.io found that 4,035 delegations were active on the Ethereum chain in just 40 minutes, with 2.99% of total transactions being delegation transactions. The most frequent targets for these delegations were contracts named Poisoner and CrimeEnjoyor, which are used for address poisoning and sweeping funds respectively.