EIP-7702 Wallet Delegation Faces Scrutiny After Phishing Research
EIP-7702 lets Ethereum accounts delegate code execution, enabling smarter wallet features like batched transactions, sponsored gas, and more flexible account control. New research presented at USENIX Security found that, in the analyzed sample, 63% of EIP-7702 authorization transactions were linked to attacker-controlled contracts, with automated wallet-draining tied to over $2.3 million in confirmed thefts. This does not indicate an inherent protocol bug; the main risk comes when users are tricked into signing malicious delegations. The feature expands phishing opportunities because a misleading signature can grant much broader control than a normal approval. The key security boundary is often the wallet interface, so clearer prompts, better simulation, delegation warnings, and contract reputation checks are needed. The goal is to keep account abstraction benefits while reducing user confusion and phishing damage.
