Attackers drove 63% of early EIP-7702 authorizations

A peer-reviewed study released for USENIX Security ’26 found attacker-linked contracts were associated with 2,322,548 of 3,664,166 EIP-7702 authorization transactions observed across seven blockchains through July 15, 2025. The figure represents 63% of the authorization transactions in the researchers’ dataset.

The research team scanned more than 22.8 billion historical transactions on Ethereum, Binance Smart Chain, Polygon, Optimism, Arbitrum, Base and Gnosis to locate the 3,664,166 EIP-7702 authorizations included in the analysis. Using transaction filters, bytecode analysis and manual review, the researchers identified 924 malicious contracts tied to those authorizations. They classified 793 as targeting externally owned accounts, 124 as targeting contract accounts and seven as composite attacks.

EIP-7702, activated on May 7, 2025 as part of the Pectra upgrade, introduced a type-4 transaction that lets a conventional externally owned account set a pointer to deployed contract code. The account address and private key remain the same, but calls to the account can execute the delegated contract’s code in the account’s context. The mechanism allows wallets to offer batched calls and sponsored transactions without requiring users to move funds to new addresses.

The researchers report that a small set of reused malicious contracts drove much of the observed authorization volume. They identified patterns that affected monitoring and defenses, including attackers rebinding accounts to benign code after theft to hide past activity, and about 500 delegation targets that pointed to precomputed addresses with no deployed code. Those addresses can later receive code via CREATE2, changing what an account executes while the recorded pointer remains unchanged.

The paper measured $2,362,848.76 in detected theft across three attack categories. In a separate analysis of legacy contracts that relied on msg.sender == tx.origin as a flash-loan defense, the team identified 967 active Ethereum contracts holding roughly $10.1 million that the authors describe as potentially exposed because EIP-7702 invalidates that assumption.

To reduce risk, the study and guidance on ethereum.org recommend that wallets treat delegation like an installation of the account control plane. The documents call for restricting who can request delegation, displaying the exact target contract and initialization parameters, avoiding arbitrary delegation on hardware wallets, and relying on publicly audited implementations. An account-abstraction wallet proposal cited in the paper advocates a short list of well-known smart-account implementations. Developers are advised to request needed features via interfaces such as ERC-5792 and to sign initialization parameters or restrict setup to the ERC-4337 EntryPoint to prevent front-running substitution.

The authors note their measures capture transaction volume rather than the number of distinct affected wallets. Their detection method may miss malicious contracts created before visible preparation transactions or attacks using novel interfaces outside the study’s coverage. The paper calls for durable authorization records and ongoing monitoring to track changes in delegated code and authorization history.