Security research presented at the USENIX Security Symposium found that 63% of analyzed EIP-7702 authorization transactions were linked to attacker-controlled contracts. More than $2.3 million in confirmed thefts were attributed to automated wallet-draining activity exploiting the feature. The issue stems from expanded attack surface when users are tricked into signing malicious authorizations, not from an inherent Ethereum protocol bug. EIP-7702 allows externally owned accounts to temporarily delegate code execution, enabling better wallet experiences but also creating new risks when delegation permissions are poorly understood. Wallet teams, security researchers, and developers will need to improve how delegation permissions are displayed and protected to preserve the benefits of account abstraction without facilitating phishing.
Source: Read the original article
