EIP-7702 Wallet Delegations Put User Authorizations at the Center

Ethereum’s EIP-7702 lets ordinary wallets run smart-contract code after a signed authorization, making control of that approval central to how users assess the feature’s security.

EIP-7702 was introduced with Ethereum’s 2025 Pectra upgrade. It applies to externally owned accounts, or EOAs, which are ordinary Ethereum accounts controlled by a private key. Under the standard, an account signs a message authorizing code to act for it. That gives a standard wallet smart-contract functions, including the ability to group steps that otherwise would require separate transactions.

A token swap offers one example: a user can combine token approval and the swap, rather than submit an approval transaction and then a second transaction to trade. The same ability to perform several actions together can also move multiple token balances at once.

Derek Chiang, founder of ZeroDev, an account-abstraction wallet developer, said the key security question is how an attacker obtains authorization, not merely whether a wallet supports EIP-7702. Chiang said attackers would need a wallet’s private key or a signed authorization to use the delegation to move assets. The feature alone does not expose every wallet that supports it.

The Binance 14 hot-wallet sweep illustrated that capability: one transaction moved Ether (ETH) and 63 token balances. Chiang said separate token transfers would have competed with Binance’s withdrawals for transaction nonces, sequential numbers used to order transactions from an account, and some could have failed amid that activity.

Binance’s preliminary investigation found no evidence that the wallet’s private key had leaked. Chiang recommended that users choose well-known wallet providers.

Chiang also pointed to draft EIP-8141 as a possible way to add conditions to transactions. In his example, a wallet could require another signer before permitting a transfer above 1,000 ETH. EIP-8141 remains a draft proposal.