The authority behind the request
EIP-7702 allows a key-controlled Ethereum account to authorize a delegation indicator pointing to code. That code can then execute in the account's context. A malicious prompt may disguise this authority as a harmless login, upgrade, or account-repair step. The risk is broader than approving one transfer: the account is authorizing executable behavior whose permissions and persistence depend on the delegation and implementation.
2 sources for this section
A defensive reading of the prompt
Before authorizing a delegation, identify the intended network, delegate address, implementation, and reason for the request. A familiar application name or a zero-value outer transaction does not establish that the permission is harmless. A sponsored transaction may let someone else submit the authorization, so the absence of an ordinary gas payment by the user does not imply the absence of an on-chain effect. Wallet presentation should make these distinctions visible.
1 source for this section
Recovery and remaining risk
Delegation persists until changed or cleared under the protocol rules; it is not automatically erased after one transaction. Clearing it can limit future delegated behavior but cannot undo transfers already completed. Separate token allowances or other previously granted permissions may also remain. The EIP discusses implementation risks including initialization and storage handling, so choosing a legitimate-looking delegate is not a substitute for secure code. A suspected incident requires examining the actual authorization and resulting account state, not merely disconnecting a website.
2 sources for this section
The source notesEvidence & further reading3 sources
- EIP-7702: Set code for externally owned accounts Ethereum Improvement Proposals · Primary source · accessed 2026-09-21
- Prague-Electra: Pectra Ethereum.org · Primary source · accessed 2026-09-21
- ERC-20: Token standard Ethereum Improvement Proposals · Primary source · accessed 2026-09-21