EIP-7702 Wallet Delegation Faces Scrutiny After Phishing Research

Ethereum’s EIP-7702 wallet delegation feature is facing renewed scrutiny after security research presented at the USENIX Security Symposium linked a large share of analyzed authorization transactions to attacker-controlled contracts.

The research found that 63% of EIP-7702 authorization transactions in the analyzed sample were connected to malicious contracts, with automated wallet-draining activity contributing to more than $2.3 million in confirmed thefts.

That sounds alarming, but the framing matters.

This is not the same as saying EIP-7702 has an inherent protocol bug. The concern is that wallet delegation can expand the attack surface when users are tricked into signing malicious authorizations.

In other words, the danger sits at the intersection of protocol flexibility, wallet UX, user behavior, and phishing infrastructure.

• Security research linked 63% of analyzed EIP-7702 authorization transactions to attacker-controlled contracts.
• The research identified more than $2.3 million in confirmed thefts.
• The issue is malicious delegation and wallet attack surface, not necessarily a core Ethereum protocol bug.

EIP-7702 is part of Ethereum’s broader account-abstraction direction.

It allows externally owned accounts to temporarily behave more like smart contract accounts by delegating code execution. That opens the door to better wallet experiences, batched transactions, sponsored gas, automation, and more flexible account controls.

Those features can be useful.

But flexibility also creates new user risks. If a malicious site convinces a user to sign the wrong delegation authorization, the attacker may gain far more power than a typical phishing signature would allow.

That is why wallet design matters so much.

A powerful feature can become dangerous if users cannot clearly understand what they are authorizing.

Attackers adapt quickly.

When crypto wallets become more capable, phishing campaigns evolve to exploit those capabilities. In earlier cycles, attackers focused heavily on seed phrases, malicious approvals, fake airdrops, and wallet-draining signatures.

Delegation adds another tool.

A user may think they are signing a routine transaction or interacting with a normal application, when they are actually authorizing code that gives an attacker dangerous control. Once that happens, automated systems can drain assets quickly.

The research’s $2.3 million loss figure shows that this is not just theoretical.

Ethereum security is often discussed at the protocol level.

But for most users, wallet interfaces are the real security boundary. A protocol can be technically sound while users still lose funds because prompts are confusing, permissions are unclear, or malicious transactions are hard to interpret.

EIP-7702 makes that more important.

Wallets may need clearer warnings, better simulation tools, stronger delegation displays, contract reputation checks, and safer default flows. Users need to know when a signature gives a contract meaningful control over their account.

If they cannot understand the permission, they cannot judge the risk.

It would be too simple to say EIP-7702 is “bad.”

Account abstraction is a major part of making Ethereum easier to use. Better wallets could reduce friction, improve onboarding, and help ordinary users avoid some of the problems that make crypto feel difficult today.

The problem is implementation and user protection.

New capabilities need matching safety tools. Otherwise, attackers get the benefit before normal users do.

That has happened before in crypto.

Every time the user experience becomes more complex, malicious actors look for confusion. EIP-7702 is no different.

The next step is not panic. It is hardening.

Wallet teams, security researchers, dapp developers, and Ethereum infrastructure providers will need to improve how delegation permissions are displayed, simulated, and restricted. The goal should be to preserve the benefits of account abstraction without making phishing easier.

For users, the message is simpler: delegation signatures deserve extra caution.

If a wallet prompt is unclear, if a site is unfamiliar, or if a signature appears to grant broad account permissions, the safest move is to stop.

Ethereum’s account-abstraction roadmap remains important. But this research shows that better wallet power must come with better wallet safety.

This article is based on security research presented at the USENIX Security Symposium and public reporting on EIP-7702 authorization activity.

This article was written by the News Desk and edited by Samuel Rae.

This report is based on information released in disclosures at primary source documentation.