EIP-7702 Explained Simply: What the Upgrade Does, What It Enables, and How Scammers Weaponized It

EIP-7702 sounds like infrastructure trivia until a drainer uses it against you. In plain terms: since the Pectra upgrade, a normal wallet (an EOA) can set code on itself — gaining smart-contract capabilities without migrating to a new address. That’s genuinely useful, and it’s also the mechanism behind the nastiest drainer wave of 2026: one phished signature, permanent sweeper. Here’s the whole thing in plain language.

What is EIP-7702 in simple terms?

Before Pectra, wallets came in two kinds: EOAs (normal wallets — controlled by a key, no code) and contract wallets (code on-chain, flexible but separate addresses). 7702 lets an EOA temporarily or permanently adopt code by signing a special authorization — the code lives at your same address, so your balance, history, and identity stay put. The adopted code is a pointer (a 3-byte designator plus the delegate contract’s address), and the delegate’s functions run “as” your wallet. Smart-account features — batching, gas sponsorship, recovery logic — without changing addresses. The technical detail for the curious: the code begins with the 0xef0100 prefix followed by the delegate address, which is exactly what the delegation checker reads.

The legitimate uses

Wallet apps use 7702 to ship smart-account features to existing addresses: transaction batching (approve-and-swap in one click), gas payment in tokens other than ETH, session keys with spending limits, and social-recovery patterns. If your wallet app “upgraded your account,” a delegation may be legitimate — check that the delegate is labeled and expected. The 7702 vs Permit2 comparison covers how this differs from the older approval paradigm.

How scammers weaponized it

The same mechanism, phished: a fake site requests one signature framed as “upgrade,” “claim,” or “verify” — and the signed authorization delegates your wallet to the scammer’s contract. From that moment, the delegate’s sweep function runs against every deposit your address receives — no further signature, no prompt, nothing in your wallet UI. The October 2026 wave tied $1.54M to a single sweeper contract; the anatomy and case study are in the delegation attacks piece and the CrimeEnjoyor analysis.

What every wallet owner should do

1. Check your delegation state now — takes two minutes: Etherscan’s “Delegated Address” field (Null = clean), or the free CLI check, or our browser checker.
2. Treat unknown delegations as hostile — the revoke procedure is in the walkthrough: fund with only gas, send a type-0x04 re-delegation to null, verify.
3. Monthly cadence if you hold anything meaningful — delegation can sit dormant for weeks before you deposit.
4. If phished: revocation alone isn’t enough if your seed was also compromised — run the first-24-hours sequence.

FAQ

What does EIP-7702 actually do? Lets a normal wallet (EOA) set code on itself by signing an authorization — gaining smart-account capabilities at the same address without migrating. The code is a pointer to a delegate contract.

Is EIP-7702 dangerous? The mechanism is neutral; the risk is authorization control. A delegation to a contract you chose is a feature. One signed to an attacker’s contract is a permanent sweeper on your address — check yours with the free tool.

Can a 7702 delegation steal funds without signatures? Future deposits, yes — the delegate contract sweeps incoming transfers automatically. Existing funds require the attacker to also hold your key or have prior approvals.

How do I remove a 7702 delegation? Send a type-0x04 transaction re-delegating to the null indicator (recent wallet builds expose “remove delegation”). Fund the address with only the gas needed — sweepers watch delegated addresses. Full procedure: the revoke walkthrough.

Does 7702 replace seed phrases? No — the EOA’s key still controls everything; the delegation just adds code capabilities. Which also means: a phished seed plus a delegation is total compromise — see the emergency checklist.

Is 7702 live on all chains? On chains that shipped Pectra. If your funds span chains, check each — the CLI tool accepts any chain’s public RPC.

Educational content, not financial advice. Not affiliated with the Ethereum Foundation or Polymarket. Last updated October 2026.