A peer-reviewed study found that 63% of early EIP-7702 wallet authorizations were linked to attacker-controlled contracts, exposing millions in user assets and highlighting new risks for Ethereum and compatible chains
Ethereum's recent Pectra upgrade, which introduced the EIP-7702 smart wallet feature, has opened the door to a wave of attacks targeting users across multiple blockchains. According to a peer-reviewed study released for USENIX Security '26, attacker-linked contracts were responsible for 63% of the 3.66 million EIP-7702 authorization transactions observed through July 15, 2025, spanning Ethereum, Binance Smart Chain, Polygon, Optimism, Arbitrum, Base, and Gnosis. The researchers identified 2,322,548 transactions tied to malicious contracts, resulting in at least $2.36 million in confirmed losses and exposing an estimated $10.14 million in additional assets to risk due to outdated contract assumptions.
How EIP-7702 Changes Wallet Security
EIP-7702 allows externally owned accounts (EOAs)-the standard type of Ethereum wallet-to delegate control to smart contract code without changing their address or private key. This upgrade enables features like batched transactions and sponsored gas payments, but it also means that any code pointed to by the wallet can act with full account authority. If a user unknowingly delegates to buggy or malicious code, that code can approve transfers, move funds, or interact with decentralized applications as if it were the account owner. The protocol verifies the account owner's signature, but the wallet interface is responsible for showing users what code they are granting control to-a step that can be easily obscured or manipulated by attackers.
Attack Patterns and Losses
The study's authors analyzed over 22.8 billion historical transactions and identified 924 malicious contracts, most of which repeatedly targeted EOAs. Attackers often prepared authorization fields off-chain and tricked victims into signing them, sometimes rebinding the account to benign code after an attack to evade detection. The researchers also found 500 special delegation targets with no deployed code, which could later receive malicious code via precomputed addresses. This makes it difficult for wallets and monitoring tools to assess risk based solely on the current state of an account. The $2.36 million in measured losses came from three main attack categories, while the $10.14 million exposure figure reflects assets at risk in legacy contracts that relied on outdated security checks, such as assuming `msg.sender == tx.origin` would always identify a plain EOA.
Wallet Guidance and Mitigation
In response to these findings, Ethereum Foundation guidance now recommends that wallets treat delegation as a controlled installation process, only allowing whitelisted, audited contracts and clearly displaying the target code to users. Hardware wallets are advised to avoid arbitrary delegation, and developers are encouraged to use wallet interfaces like ERC-5792 to request features rather than direct low-level delegation. The study also highlights a related risk: when an account delegates to an existing contract, the contract's constructor does not run again, potentially leaving ownership unset and vulnerable to external claims. Wallets are urged to maintain durable authorization records, alert users to delegation changes, and provide clear removal paths.
Broader Security Implications
The scale of EIP-7702-related attacks underscores the need for robust wallet security practices and ongoing monitoring. The researchers caution that their detection methods may miss new attack vectors or contracts that become malicious after initial deployment. As the Ethereum ecosystem continues to evolve, the responsibility for safe wallet programmability increasingly falls on wallet developers and infrastructure providers. This shift in risk is reminiscent of the challenges highlighted in EgonCoin's coverage of how "audited" badges on crypto platforms can give users a false sense of security, as seen in recent reporting on audit badge limitations.
According to the study, the 3,664,166 EIP-7702 authorization transactions analyzed through July 15, 2025, spanned seven major blockchains. Of these, 2,322,548 transactions-63%-were linked to attacker-controlled contracts. The researchers measured $2,362,848.76 in realized losses and identified $10.14 million in assets at risk due to legacy contract assumptions. The dataset included 924 manually verified malicious contracts, with 793 targeting EOAs, 124 targeting contract accounts, and seven classified as composite attacks.
Delegation in Ethereum wallets fundamentally changes the security model for users. While EIP-7702 brings powerful new features, it also introduces risks that are not always visible to end users. The ability to point an account to arbitrary code means that a single mistaken authorization can have lasting consequences, especially if the wallet interface fails to make the risks clear. As wallet infrastructure becomes more programmable, the burden of vetting and monitoring delegated code grows. Users, developers, and wallet providers must adapt to a landscape where historical authorization records, code audits, and ongoing vigilance are essential to protecting digital assets.
