EIP-7702: how to check and revoke a wallet delegation before someone abuses it

What an EIP-7702 delegation is[1][5][2]

An ordinary EVM wallet such as MetaMask or Rabby is an EOA: an address with a private key and no code of its own. EIP-7702 went live with the Pectra upgrade on 7 May 2025 and lets such an address sign an authorization that points to a contract. From then on, whenever it is called, your address runs that contract's code as if it were a smart contract itself.

An authorization holds three things: a chain ID, the contract address and a nonce, the account's next transaction number. Once the network accepts it, the account's code gets the marker 0xef0100 followed by the contract address.

There are honest uses. MetaMask calls it a smart account: several actions in one transaction, or gas paid by someone else. MetaMask says it supports this only for its own contract.

Why one signature weighs more than an approve[1][6]

An ordinary approve gives a contract a right to one token, usually up to a set amount. A delegation works differently. The specification says plainly that the code an authorization points to has unrestricted access to the account. That code can send ETH and every token, at any time.

A delegation is persistent: it stays on the account until you sign a new one. If there are several valid authorizations, the last one wins. An authorization with chain ID 0 is valid on every EVM network, so one signature can open your address on Ethereum, Base and BNB Chain at once.

The EIP's authors write that there is no safe way to let sites ask for such signatures, and that it is the wallet's duty not to offer that interface. If a site asks you to sign an authorization for a contract you do not know, stop.

How delegation hurts ordinary users[5]

According to Wintermute, in the first weeks after Pectra more than 97% of EIP-7702 delegations pointed to nearly identical sweeper contracts. Such a contract automatically drains any ETH that lands on the address. Thieves set it up on addresses whose private keys they have already taken.

The second scenario is phishing. According to Scam Sniffer, one Ethereum user lost US$146,550 after unknowingly signing a batch of malicious EIP-7702 transactions. The pattern is the same as with drainers on fake airdrops: a site asks for a signature that looks harmless and hands someone control.

How to check whether your address has a delegation[4][3][2]

The simplest way is a delegation checker, such as the Delegation Checker described by Curvegrid. You enter an address and see a status for each network: no delegation, or a delegation with a link to the contract. The tool also flags contracts known from thefts. Curvegrid notes that some block explorers do not show delegation clearly.

You can also check the address's code in an explorer or over RPC. An ordinary wallet has empty code, 0x. If the code starts with 0xef0100, the account is delegated, and the contract address follows that prefix.

In MetaMask, open Account details, then Smart account. You will see a toggle for each network there.

• Check every EVM address you use, on each network separately
• A contract from MetaMask or another wallet that you switched on yourself: fine
• An unknown contract or one flagged as malicious: revoke the delegation and check whether the key has leaked
• Do not leave a delegation you do not remember just in case

How to revoke a delegation[1][3][2][4]

Revoking is a new authorization pointing to the zero address (0x0000…0000). The specification says the account's code then returns to empty and the address is an ordinary EOA again. Changing the delegation does not, however, clear data the contract wrote to the account (storage), and the protocol has no separate function for that.

In MetaMask, open Account details and Smart account, switch off the toggle for the network and confirm the transaction. It costs a small gas fee, and switching it back on later costs one again. Other wallets vary: according to Curvegrid, many wallets cannot send the transaction that revokes an arbitrary delegation at all.

After revoking, check again. The address's code should be 0x once more.