The delegation feature of Ethereum’s EIP-7702 wallet is under scrutiny after security research presented at the USENIX Security Symposium linked a large portion of analyzed authorization transactions to contracts controlled by attackers.
The research found that 63% of EIP-7702 authorization transactions in the sample analyzed were linked to malicious contracts, with automated wallet emptying activity contributing to over $2.3 million in confirmed theft.
This sounds alarming, but framing matters.
This is not to say that EIP-7702 has an inherent protocol bug. The problem is that wallet delegation can expand the attack surface when users are tricked into signing malicious permissions.
In other words, the danger lies at the intersection of protocol flexibility, wallet UX, user behavior, and phishing infrastructure.
TL;DR
- Security research linked 63% of analyzed EIP-7702 authorization transactions to contracts controlled by attackers.
- The research identified more than $2.3 million in confirmed thefts.
- The problem lies in malicious delegation and the wallet attack surface, not necessarily a core bug in the Ethereum protocol.
What changes EIP-7702
EIP-7702 is part of Ethereum’s broader focus on account abstraction.
It allows external accounts to temporarily behave more like smart contract accounts by delegating code execution. This opens the door to better wallet experiences, batch trading, sponsored gas, automation and more flexible account controls.
These features can be useful.
But flexibility also creates new risks for users. If a malicious site convinces a user to sign the wrong delegation permission, the attacker can gain far more power than a typical phishing signature would allow.
This is why portfolio design is so important.
A powerful feature can become dangerous if users cannot clearly understand what they are allowing.
Phishing evolves with technology
Attackers adapt quickly.
As crypto wallets become more capable, phishing campaigns evolve to exploit these capabilities. In previous cycles, attackers focused heavily on seed phrases, malicious approvals, fake airdrops, and wallet-depleting signatures.
Delegation adds another tool.
A user may think they are signing a routine transaction or interacting with a normal application, when they are actually authorizing code that gives dangerous control to an attacker. Once this happens, automated systems can quickly drain assets.
The study’s figure of $2.3 million in losses shows that this is not just theoretical.
Wallet UX is now a security layer
Ethereum security is often discussed at the protocol level.
But for most users, wallet interfaces are the real limit of security. A protocol can be technically sound but users still lose funds because prompts are confusing, permissions are unclear, or malicious transactions are difficult to interpret.
EIP-7702 makes this more important.
Wallets may require clearer warnings, better simulation tools, stronger delegation displays, contract reputation checks, and more secure default flows. Users need to know when a signature gives a contract significant control over their account.
If they can’t understand the authorization, they can’t judge the risk.
Don’t blame functionality alone
It would be too simple to say that the EIP-7702 is “bad”.
Account abstraction is a major part of making Ethereum easier to use. Better wallets could reduce friction, improve onboarding, and help everyday users avoid some of the problems that make crypto difficult today.
The problem is implementation and user protection.
New capabilities require appropriate security tools. Otherwise, attackers will take advantage before normal users.
This has already happened in crypto.
Whenever the user experience becomes more complex, bad actors look for confusion. EIP-7702 is no different.
What comes next
The next step is not panic. It hardens.
Wallet teams, security researchers, dapp developers, and Ethereum infrastructure providers will need to improve how delegation permissions are displayed, simulated, and restricted. The goal should be to preserve the benefits of account abstraction without facilitating phishing.
For users, the message is simpler: delegation signatures deserve greater caution.
If a wallet prompt is unclear, a site is unfamiliar, or a signature appears to grant broad permissions to the account, the safest course is to stop.
Ethereum’s roadmap for account abstraction remains significant. But this research shows that better wallet power must be accompanied by better wallet security.
This article is based on security research presented at USENIX Security Symposium and public reporting on EIP-7702 authorization activity.
This article was written by the News Desk and edited by Samuel Rae.