Research links 63% of EIP-7702 authorizations to attacker contracts

2 min

Security research presented at the USENIX Security Symposium linked a majority of analyzed Ethereum EIP-7702 authorization transactions to attacker-controlled contracts. The findings emphasize expanded attack surface from wallet delegation and the need for stronger wallet-side protections rather than indicating a core protocol flaw.

Key Findings

63% of analyzed EIP-7702 authorization transactions connected to attacker-controlled contracts.
Confirmed thefts exceeded $2.3 million, largely via automated wallet-draining activity.
Risk driver: malicious delegation and broadened wallet attack surface, not an inherent Ethereum protocol bug.

What EIP-7702 Changes

EIP-7702 advances account abstraction by allowing externally owned accounts to temporarily delegate code execution like smart contract accounts. Benefits: batched transactions, sponsored gas, automation, and flexible account controls. The same flexibility increases risk when users sign deceptive delegations that grant attackers elevated control.

Phishing Evolves With Capability

Attackers shift from seed phrase theft and malicious approvals toward exploiting delegation. Users may believe they are executing routine actions while authorizing code that enables rapid asset drains. The documented $2.3 million in losses validates active exploitation.

Wallet UX as a Security Boundary

For typical users, wallet interfaces function as the primary security layer. Technically sound protocols cannot prevent losses when prompts obscure permissions or signatures are hard to interpret. With EIP-7702, wallets need clearer warnings, robust simulations, explicit delegation displays, contract reputation checks, and safer defaults so users can assess when a signature grants meaningful control.

Assessing the Feature

EIP-7702 itself is not labeled defective. It supports Ethereum’s account-abstraction roadmap that targets improved usability. The issue lies in implementation and user protection: new capabilities require commensurate safety tooling, or attackers will capitalize first.

Next Steps

Hardening is required across wallets, dapps, and infrastructure: improve delegation permission displays, enhance simulations, apply restrictions, and integrate reputation signals to retain account-abstraction benefits while constraining phishing leverage. Users should treat delegation signatures with heightened caution and avoid proceeding when prompts are unclear or imply broad account permissions.

Source: security research disclosed at the USENIX Security Symposium and public reporting on EIP-7702 authorization activity.