What is EIP-7702?

EIP-7702 is an Ethereum Improvement Proposal that lets an externally owned account, the key-based account most wallets use, delegate to smart contract code. It went live in the Pectra upgrade on May 7, 2025. The proposal is titled "Set Code for EOAs" and lists Vitalik Buterin among its four authors.

What is EIP-7702 delegation?

Delegation means the account points to a contract and borrows its logic. The owner signs a short message called an authorization, which names a chain ID, the address of the contract to use and the account's current nonce. That authorization is carried in a new transaction type, numbered 4.

Once processed, the account stores a small marker that points to the chosen contract. When the account is called, Ethereum runs the contract's code as if it were the account's own.

A few details shape how this works in practice:

• Chain ID. An authorization with a specific chain ID works only on that network. A chain ID of 0 makes it valid on every compatible chain.
• Nonce. The authorization is tied to the account's nonce, so it cannot be replayed once the nonce moves on.
• Revoking. The owner can sign a new authorization pointing elsewhere, or point it at the zero address to clear the delegation entirely.

The wider case for smart accounts is covered in what is account abstraction.

How do wallets use EIP-7702?

Wallets decide which contract their users delegate to. MetaMask, for example, calls the result a smart account. It points the account to MetaMask's own delegator contract to enable features such as batching an approval and a swap into one step, or paying gas in a token other than ETH. MetaMask says funds do not move, the address stays the same and the Secret Recovery Phrase still controls the account. Users switch on or off per network, and each change costs a small gas fee.

The EIP itself advises wallets not to let websites ask for arbitrary authorization signatures, because few users can check what the delegated code does.

What are EIP-7702 scams?

The biggest early abuse targeted wallets that were already compromised. In June 2025, The Block reported that trading firm Wintermute found more than 80% of EIP-7702 delegations linked to copies of one malicious contract, which it nicknamed CrimeEnjoyor. The contract automatically sweeps funds out of accounts whose private keys have leaked. Security researcher Taylor Monahan told The Block the root problem was leaked keys, and that EIP-7702 mainly made sweeping cheaper for attackers.

A second risk is phishing. Blockworks noted that EIP-7702 does not bypass signatures, since an attacker still needs the victim to sign a malicious delegation. A signed delegation to a harmful contract can give that code control of the account. Practical checks follow:

• Treat any message urging you to "upgrade" your account as suspect. MetaMask says it does not email users about upgrading.
• Do not sign requests shown as unreadable data.
• Prefer wallets that flag delegation requests and name the contract involved.

Our guide to phishing and wallet drainers covers the wider tactics.