EIP-7702
An Ethereum Improvement Proposal that allows externally owned accounts (EOAs) to set delegation code for themselves by signing an authorization tuple, giving EOAs smart account capabilities without migrating assets or changing addresses. It is part of the broader account abstraction effort.
Timeline (last 90 days)
EIP-7702 launched with Ethereum's Pectra upgrade, allowing an EOA to set code for itself by signing an authorization tuple, and the code becomes a delegation indicator in the format 0xef0100 || <delegation address>.
After EIP-7702 authorization the account is still an EOA—the address, private key, and nonce semantics are all preserved, it is just that each call additionally executes the code of the delegated address, and the EOA is not turned into a contract account.
The EIP-7702 authorization tuple contains six fields: chain_id, address, nonce, y_parity, r, s; the signer can be recovered from the tuple via ecrecover.
Blockchain explorers typically do not proactively highlight the information that "the address code has been delegated to another contract", showing only transaction history, balance, and token holdings, causing information asymmetry.
Calling eth_getCode on any address: returning empty indicates an ordinary EOA, returning data beginning with 0xef0100 indicates it has been delegated, and the following 20 bytes are the delegation address; a delegated account can have a completely clean and very short transaction history.
0xef0100 is a magic byte prefix reserved by EIP-3541, and ordinary contracts cannot deploy code beginning with it, so it can serve as a deterministic marker for judging whether an address has been delegated via EIP-7702.
eth_getCode returns 23 bytes of data beginning with 0xef0100 for an EIP-7702 delegated account (3-byte prefix + 20-byte delegation address).
In a case of an EIP-7702 wallet delegated to a draining contract, researchers used ecrecover to recover the signers of six authorization tuples and found that all six came from the same key and all pointed to the same delegation address.
In that case, the bytecode of the delegation address was very short, and upon receiving a transfer it forwarded directly to a hardcoded address with no conditional branches, so sending 0.01 ETH resulted in it all being transferred away.
For a delegated wallet that has just had a transfer occur, a "small test" is not an effective security strategy, and the only safe transfer amount is zero.
1 more timeline events
All Facts (11)
The on-chain pre-check process for the EIP-7702 draining trap includes three steps: read the address code (eth_getCode), read the delegation contract code, and read the authorization tuple and verify the signer with ecrecover.
50%UnverifiedAfter EIP-7702 authorization the account is still an EOA—the address, private key, and nonce semantics are all preserved, it is just that each call additionally executes the code of the delegated address, and the EOA is not turned into a contract account.
50%UnverifiedThe EIP-7702 authorization tuple contains six fields: chain_id, address, nonce, y_parity, r, s; the signer can be recovered from the tuple via ecrecover.
50%UnverifiedBlockchain explorers typically do not proactively highlight the information that "the address code has been delegated to another contract", showing only transaction history, balance, and token holdings, causing information asymmetry.
50%UnverifiedCalling eth_getCode on any address: returning empty indicates an ordinary EOA, returning data beginning with 0xef0100 indicates it has been delegated, and the following 20 bytes are the delegation address; a delegated account can have a completely clean and very short transaction history.
50%Unverified0xef0100 is a magic byte prefix reserved by EIP-3541, and ordinary contracts cannot deploy code beginning with it, so it can serve as a deterministic marker for judging whether an address has been delegated via EIP-7702.
50%Unverifiedeth_getCode returns 23 bytes of data beginning with 0xef0100 for an EIP-7702 delegated account (3-byte prefix + 20-byte delegation address).
50%UnverifiedEIP-7702 launched with Ethereum's Pectra upgrade, allowing an EOA to set code for itself by signing an authorization tuple, and the code becomes a delegation indicator in the format 0xef0100 || <delegation address>.
50%UnverifiedIn that case, the bytecode of the delegation address was very short, and upon receiving a transfer it forwarded directly to a hardcoded address with no conditional branches, so sending 0.01 ETH resulted in it all being transferred away.
50%UnverifiedFor a delegated wallet that has just had a transfer occur, a "small test" is not an effective security strategy, and the only safe transfer amount is zero.
50%UnverifiedIn a case of an EIP-7702 wallet delegated to a draining contract, researchers used ecrecover to recover the signers of six authorization tuples and found that all six came from the same key and all pointed to the same delegation address.
50%