Does My Wallet Have an EIP-7702 Delegation? How to Check (CLI + Browser)

Q: Can a 7702 delegation steal my funds without a signature?

It steals *future* deposits: anything sent to the delegated address gets swept by the attacker's contract automatically. Existing funds leave only if the attacker also holds your key or has active approvals.

Q: Is there a free tool to check EIP-7702 delegation?

Yes: [github.com/sreyleak-security/eip7702-check](https://github.com/sreyleak-security/eip7702-check) (CLI, scriptable, exit codes for automation), our [browser checker](/tools/eip-7702-delegation-checker), and plain Etherscan. All read-only — none of them should ever ask for your seed phrase.

Srey Leak· security · Updated October 2026

Since Pectra shipped EIP-7702, the scariest scam doesn’t ask you to sign anything at the moment of theft. One phished “upgrade” authorization — signed weeks ago, or never noticed — delegates your wallet to an attacker’s contract, and a sweeper bot drains every future deposit automatically. The October 2026 wave tied $1.54M to a single sweeper contract. Checking whether your wallet is delegated takes two minutes and costs nothing. Here are three ways to do it, and what to do if the answer is bad.

How do I check if my wallet has an EIP-7702 delegation?

Three routes, all read-only: (1) look up your address on Etherscan and read the Delegated Address field — Null means clean; (2) run a free CLI command that queries the chain directly; (3) use the browser checker on our research hub. All three do the same thing underneath: they read your account’s code and look for the 7702 designator prefix (0xef0100) followed by the delegate contract’s address.

Method 1: Etherscan (no tools)

Open etherscan.io and paste your address
Find the “Delegated Address” field in the account summary
Read it:
- Null — no delegation. Clean.
- A labeled contract you knowingly upgraded to — expected (some wallet apps do this legitimately).
- An unknown contract — your wallet is delegated to something you didn’t choose. Treat the address as hostile and act today.

Method 2: the CLI (scriptable, cron-friendly)

I maintain a free open-source checker that sends a single read-only eth_getCode call to any public RPC — no keys, no wallet connection:

git clone https://github.com/sreyleak-security/eip7702-check.git
cd eip7702-check
python3 eip7702_check.py --address 0xYourAddress

# any chain:
python3 eip7702_check.py --address 0xYourAddress --rpc https://polygon-rpc.com

Clean output:

[OK] 0xabc...: no active EIP-7702 delegation (code is empty).
     Delegated Address on explorers should read: Null

Delegated output:

[!] 0xabc... HAS an active EIP-7702 delegation.
    Delegated to : 0xdead...
    Action       : verify this contract on a block explorer.
                   Unknown contract → revoke via a type-0x04 tx

The tool exits with code 1 when a delegation exists and 0 when clean — drop it into cron to monitor cold wallets automatically. It’s the same parser that powers our browser checker, packaged for people who don’t want to paste a wallet address into any website (reasonable).

What a delegation actually is (30 seconds)

Under EIP-7702, a normal wallet (EOA) can set code on itself — that’s how legitimate smart-account features ship without migrating addresses. The code is just a pointer: a 3-byte designator (ef0100) plus 20 bytes of delegate contract address. Attackers abuse the same mechanism: their drainer contract becomes your wallet’s “code,” and its sweep function runs against anything you deposit. No further signature, no prompt — the one-signature drainer pattern in its purest form.

If you find an unknown delegation: the revoke procedure

Stop depositing to that address immediately
Fund it with only the gas needed for one transaction — sweepers watch delegated addresses and take top-ups within minutes
Send a type-0x04 transaction re-delegating to the null indicator (recent MetaMask/Rainbow builds expose “remove delegation” — use it if available)
Verify the Delegated Address reads Null (or the CLI exits 0)
If your seed was ever phished, revocation is not enough — the attacker holds the key. Move everything to a fresh wallet; see the first 24 hours after a drain

FAQ

Q: How do I know if my wallet was compromised by EIP-7702? A: Check the delegation state: Null is clean, an unknown contract is the compromise signature. Any of the three methods above — Etherscan, the CLI, the browser checker — reads the same on-chain state.

Q: Can a 7702 delegation steal my funds without a signature? A: It steals future deposits: anything sent to the delegated address gets swept by the attacker’s contract automatically. Existing funds leave only if the attacker also holds your key or has active approvals.

Q: Is there a free tool to check EIP-7702 delegation? A: Yes: github.com/sreyleak-security/eip7702-check (CLI, scriptable, exit codes for automation), our browser checker, and plain Etherscan. All read-only — none of them should ever ask for your seed phrase.

Q: I found an unknown delegation — should I send funds to “fix” it? A: Only gas for the revoke transaction, nothing more, and only if you’re sure your key is uncompromised. Any site or DM offering to “clean” your wallet is a second scam — see fake recovery services.

Q: Does this affect Polygon/PolygonPoS wallets too? A: EIP-7702 is live on chains that shipped Pectra — check each chain your funds touch by pointing the CLI at that chain’s public RPC.

Educational content, not financial advice. Read-only tools never need your seed phrase — any “checker” that asks for it is a scam. Not affiliated with Polymarket. Last updated October 2026.