A peer-reviewed study released for the USENIX Security '26 symposium found that attacker-linked contracts were associated with 2,322,548 of the 3,664,166 EIP-7702 authorization transactions observed across seven chains through July 15, 2025 — 63% of historical transaction volume in the researchers' dataset.
Ethereum activated Pectra, including EIP-7702, on May 7, 2025. The feature allows an externally owned account to set a pointer to deployed contract code while keeping the same address and private key control. That enables batched calls and sponsored transactions without migrating assets, but it also turns the delegation target into wallet infrastructure. If the delegated code is hostile, it may make approvals, transfers, and application calls with the account's authority.
The researchers analyzed more than 22.8 billion historical transactions on Ethereum, Binance Smart Chain, Polygon, Optimism, Arbitrum, Base, and Gnosis. Within 3,664,166 EIP-7702 authorizations, they identified 924 malicious contracts, classifying 793 as EOA-targeted, 124 as contract-account-targeted, and seven as composite attacks. They measured $2,362,848.76 in realized losses and estimated about $10.14 million in potential exposure in legacy contracts whose flash-loan defenses assumed programmable EOAs could not exist.
Attackers also rebinded accounts to benign code after attacks and used 500 special nonzero delegation targets with no deployed code, making current-state-only monitoring unreliable. Post-study Ethereum Foundation guidance calls for whitelisting delegation contracts, prominently displaying targets, avoiding arbitrary delegation on hardware wallets, and relying on audited implementations. The research emphasizes that wallet interfaces are now a critical security boundary: users need clearer warnings, simulation tools, and safer default flows before signing delegation permissions.
