EIP-7702 wallet delegation is coming under scrutiny following new phishing research. Read the full analysis.
Frequently Asked Questions
Here is a list of FAQs regarding EIP7702 and the recent phishing research broken down by experience level
Beginner Questions
1 What exactly is EIP7702
Its a technical upgrade to Ethereum that allows a standard crypto wallet to temporarily act like a smart account for a single transaction This lets you do things like batch multiple actions at once or pay gas fees in different tokens without having to migrate to a completely new wallet type
2 What does wallet delegation mean in simple terms
Think of it like giving your car keys to a valet but only for one specific drive You are delegating your wallets power to a specific piece of code for a short period That code can then execute actions on your behalf but only the ones you approved
3 Why is this suddenly a security concern
Researchers found a new type of phishing attack Because EIP7702 involves signing a message to delegate your wallet scammers are tricking people into signing malicious delegation messages Once signed the scammers code can drain the wallet even if the user thinks they are just logging into a website
4 Is my wallet at risk right now
If you havent signed any new permissions recently you are likely safe The risk isnt in the technology itself but in the permission requests that pop up in your wallet If you havent approved a delegation request your funds are not exposed to this specific attack
5 How is this different from a regular phishing link
Regular phishing asks for your secret recovery phrase or private key This new attack asks you to sign a transaction or a message that looks legitimate but actually grants the hacker control It bypasses the never share your keys rule because you arent sharing keys you are granting permission
Intermediate Questions
6 What did the new research specifically find about the phishing attacks
The research highlighted that phishing sites can now craft a delegation payload that looks like a standard login request Because EIP7702 makes wallets more powerful the signature request looks similar to a benign SignIn with Ethereum prompt However embedded within that signature is a command that swaps the wallets owner to the attacker