Ethereum's EIP-7702 Delegation Feature Under Fire After Phishing Research

Ethereum's EIP-7702 wallet delegation feature is under scrutiny after security research linked 63% of analyzed authorization transactions to attacker-controlled contracts.

The research, presented at the USENIX Security Symposium, found that more than $2.3 million in confirmed thefts can be attributed to malicious activity related to EIP-7702 authorization transactions.

While the feature itself is not flawed, it can expand the attack surface when users are tricked into signing malicious authorizations.

The issue lies at the intersection of protocol flexibility, wallet user experience, user behavior, and phishing infrastructure.

EIP-7702 allows externally owned accounts to temporarily behave like smart contract accounts by delegating code execution, enabling features such as better wallet experiences, batched transactions, sponsored gas, automation, and more flexible account controls.