Security research presented at the USENIX Security Symposium has put fresh attention on Ethereum’s EIP-7702 wallet delegation feature after linking a large share of reviewed authorization activity to attacker-controlled contracts. In the analyzed sample, the researchers said 63% of EIP-7702 authorization transactions were connected to malicious contracts.

The study also identified more than $2.3 million in confirmed thefts tied to automated wallet-draining activity. The findings point to phishing and malicious delegation as the main risk, rather than evidence of an inherent flaw in Ethereum’s core protocol.

What the research found

According to the research cited in the report, abuse of EIP-7702 authorizations has already translated into measurable losses. The headline figures were that nearly two-thirds of the analyzed authorization transactions were associated with attacker-controlled contracts, and that confirmed thefts exceeded $2.3 million.

Those numbers have drawn scrutiny because EIP-7702 is designed to expand what standard Ethereum accounts can do. The research, however, focused on how that added flexibility can be turned against users when malicious infrastructure is involved.

Why the distinction matters

The report emphasized that the findings should not be read as proof of a built-in protocol bug in EIP-7702 itself. Instead, the concern is that the feature can widen the attack surface if users are deceived into approving harmful wallet delegation authorizations.

That framing is important because the threat model is different from a direct failure in Ethereum’s base rules. The risk emerges from a combination of protocol capabilities, wallet design, user behavior, and phishing tactics that persuade a victim to sign the wrong message.

What EIP-7702 changes for wallets

EIP-7702 is part of Ethereum’s broader move toward account abstraction. It lets externally owned accounts temporarily act more like smart contract accounts by delegating code execution.

That capability can support features such as improved wallet experiences, batched transactions, sponsored gas, automation, and more flexible account controls. At the same time, a mistaken or deceptive authorization may hand an attacker more control than a standard phishing signature typically would, which increases the importance of clear wallet interfaces and signing prompts.

The practical issue now

The core concern raised by the research is not simply that delegation exists, but that users may not fully understand what they are approving when a wallet asks them to sign an authorization. In that setting, technical flexibility can become a liability if the interface does not make the consequences legible.

For now, the confirmed issue described in the report is malicious delegation driven by phishing and automated draining activity. The next clear focus, based on the source material, is how wallets present EIP-7702 authorizations and whether user-facing safeguards can better distinguish legitimate delegation from attacker-controlled requests.

Source: www.newsbtc.com