Foreign code appears on your Ethereum address: How to check your EIP-7702 entrustment

EIP-7702 Delegate: How your Ethereum address was "taken over"

Since the Pectra upgrade, your Ethereum address has been able to execute other people's program code, but its address, balance or private key have not changed. The EIP-7702 achieves this feature: with just one signature, from that moment on, your address behaves like a smart contract. This is not only the basis for many convenient wallet features, but also a way for attackers to permanently control stolen accounts. This article will teach you how to check your address in two minutes to see if it carries such a commission, and what to do if you discover an unclear contract.

This article is based on real-time measurement data we conducted on the Ethereum chain. Data shows that the popularity of such commissions and their goals are thought-provoking. The answer is more severe than wallet marketing claims, but it is also more complex than mere percentages.

Impact of EIP-7702 delegation on Ethereum addresses

EIP-7702 is an extension of Ethereum that allows ordinary key-controlled accounts to run the program code of smart contracts without having to become a contract itself.

Accounts retain their private key, address, balance, and non-ce (nonce). The only thing you get is a pointer to a contract whose code will execute on behalf of the account on each call.

Technical terms call it "commission". This pointer is written into the account's code field, which was previously empty for key-controlled accounts. From that moment on, anyone calling the account is actually calling the stored contract, and the contract has access to the account's storage and balance.

The obvious benefits are: wallets can package multiple steps instead of requiring you to sign three times; providers can pay for them on their behalf; and apps can set spending rights that are strictly limited and expire in a short period of time. This is exactly what wallet manufacturers have been promoting under the "Smart Account" tab since 2025.

The cost is equally obvious: the stored contract has full rights to your account. It can transfer funds, grant approvals, and trigger further calls. Therefore, a delegation is not a setting, but a power of attorney that will remain until you replace or revoke it.

0xef0100 Code Prefix: How to identify a delegate in a chunk browser

The delegate account contains exactly 23 bytes in its code field: fixed token 0xef0100 followed by 20 bytes of the target address.

This mark is the only reliable evidence. All other content displayed on the interface is an explanation.

In practice, you'll see it in two places: the blockchain browser suddenly lists your address as a contract, or displays a note about a delegated account, even though you have never deployed a contract; and the code query provided by each browser does not return null values, but instead returns a value in ef0100 Short string at the beginning.

The next 20 bytes are the addresses you must check. They determine everything. If it is the contract address of your wallet manufacturer, then the commission may be expected. If it's something you're unfamiliar with, you're experiencing the problem of exceeding the range of missed clicks.

One thing is important for background understanding: empty code fields are good news. If you find nothing there, whether there have been commissions in the past or not, you have no active commissions now.

How to check the EIP-7702 delegation: Four steps performed in sequence

The check takes only a few minutes and requires no tools or installation.

1. Open the address in the Explorer: Enter your Ethereum address and check the page to list it as a normal account or a contract. The remarks about the entrusted account are already the result.
2. View the code field: Open the tab to store the code. Empty means there is no commission. A short string beginning with ef0100 means that the delegate is active.
3. Read the target address and find: The 20 bytes after the flag are the target address. Look for it and check if there is a verified source code and what the name of the source code is.
4. Interpret results before moving funds: If you don't recognize the contract, do not send more funds to the address, or even a fee. The next section explains why this is the most important rule in this list.

The same check applies to all chains for which EIP-7702 is in effect. Authorizations zero-signed for chain ID are even valid simultaneously on all chains. Users using multiple networks are advised to check multiple times.

How the EIP-7702 authorization works and latest data insights

EIP-7702 authorization is similar to a signed authorization power: it has no cost to the signer and remains valid until revoked.

Our September 13, 2026 measurement: 4,035 commissions in 40 minutes

This analysis was performed by www.example.com on September 13, 2026.

Method: We completely pulled 200 consecutive blocks from the public Ethereum node, namely blocks 25,971,139 to 25,971,338, and evaluated each transaction with type 0x04 and its authorization list. The time window runs from UTC 21:14:35 to 21:54:23, covering a chain time of 39.8 minutes.

Data for this window:

• There were a total of 41,110 transactions, of which 1,229 were commission transactions. It accounted for 2.99% of the total transaction volume.
• 4,035 individual authorizations, as a single transaction may contain any number of authorizations. The 889 transactions contained exactly one; the maximum contained 110.
• 56 different destination addresses. Of the 56 actual contracts, 15 have publicly verified source code, and the remaining 40 do not.
• 140 authorizations (3.5%) point to a zero target address.

These are cancellations, not new authorizations.

The four most frequently occurring goals accounted for 71.7% of all authorizations.

What we can't measure is how many accounts are currently carrying commissions in total, because this will require a full state dump of the chain, not just a time window. The data also does not show how much money was transferred through the contracts we found. And the 40-minute window is just a snapshot: another day may show a different distribution.

Poisoner and CrimeEnjoy: What the maximum goal verification source code reveals

In this measurement, names are more persuasive than shares. Two of the three most common targets have publicly verified source code, and both claim to be tools used by criminals.

has 2,007 authorizations, or 49.7% of the window, and is named Poisoner in its verification source code. Comments in the source code bluntly point out the purpose: the contract is used for address poisoning, which is to trick careless users into sending funds to visually similar wrong addresses. As the party behind the publisher, the source code mentions the trading company Wintermute, which said it rebuilt and disclosed the contract. The program code itself is short: it performs a series of arbitrary calls, but only when the transaction is triggered by the exact address where the contract was created.

The third most common target has 170 authorizations and is named CrimeEnjoy 。The explanation here is also in the source code and is capitalized: Anyone who finds this contract in the authorization list has a compromised account; no more funds must be sent to it because they will be wiped out immediately. The code is even shorter than the first contract. It only does one thing: Every incoming amount is immediately forwarded to the target address fixed at the time of setting up.

For comparison, the legal side of the same list: The eighth digit is a verification contract from a well-known wallet manufacturer with 110 authorizations, next to several contract accounts from the account abstract world, each with 10 to 49 authorizations. These contracts are thousands of bytes long, while the two suspicious targets we noticed only require 772 and 1,042 bytes. Contracts that only need to be swept require very little code.

Why a 49.7% share does not mean 2,007 victims

Caution is needed here because percentages can induce wrong conclusions. So we looked at the people who actually sent these transactions.

The result is that the 2,007 authorizations pointing to the top contract came from 186 transactions, and these 186 transactions came from a single sender. There are 176 different senders throughout the window, so almost all authorizations are traced back to an address that registers a bundle of up to 110 authorizations per minute.

Our interpretation (clearly interpretation rather than fait accompli): This pattern does not match the 2,007 new victims, but an operator configured its own one-time address. In addition to a single sender, the design of the contract also supports this view because it only performs calls for its own creator. In address poisoning, the attacker generates seemingly similar addresses himself and does not require anyone's key. In this case, we measure infrastructure rather than stolen property.

The second conspicuous contract looks different. Its 170 authorizations are spread across 170 separate transactions from two senders, i.e. one authorization for each transaction. Collecting the contract immediately forwards the incoming amount, which makes sense only for accounts where the key is already in someone else's hands. For you as a reader, the distinction is decisive: the first situation is almost certainly irrelevant to you, and the second situation is directly related to you if your account appears on the list.

Undo and defense: Protect your assets

Undo is itself an authorization: only a pointer to a zero target address can clear external code in an account.

Found a sweep contract? Why revocation is not enough

Sweeping a contract or program that automatically and quickly forwards incoming amounts to external addresses.

If you find commissions for such contracts on the address, the commissions are not the cause but the result. Someone can sign in your name, which requires your private key or mnemonic.

This results in a reverse sequence of operations to the first reaction. The instinctive reaction said: Withdraw the power of attorney and continue. The correct view is that the account has been lost, and every amount you send there, including cancellation fees, will likely fall into the hands of an attacker. The revocation fee you pay yourself is actually subsidizing the other party, in case of suspicion.

So, first create a new account, ideally on a device that has never stored a key on your computer. What designs work and how the devices differ are outlined in our software wallet comparisons and hardware choices. Anything left on the old account is processed only later and with help.

It is precisely for this situation that there is a free contact point. The source code of the sweep contract itself mentions: Flashbots White Hat Hotline . It helps bring the remaining balance through swept contracts by settling rescue and handling fees in a single bundle, so that swept contracts cannot be selected individually. This is not a guarantee, but it is the only serious way to avoid paying in advance.

Correct revocation: Zero target address as the only end

If the account is clean and delegation is just unnecessary, for example, you no longer use a wallet feature, then revocation is simple but still easily misunderstood.

Delegates do not end because you delete apps, change devices, or withdraw approvals. It ends only with a new authorization pointing to the zero target address, an address consisting entirely of zeroes. Only then will your account code field become empty again. Our measurements show that this step does happen in practice: 140 of the 4,035 authorizations in the window are for this type of revocation.

Check the code field again after revocation. An interface that reports success to you is not evidence. The evidence is an empty code field in the browser.

The second point can easily be ignored: the new delegation completely replaces the old one. Anyone who switches from one wallet provider to another will eventually get an authorization from the new provider in the account, rather than both. That's reassuring, but it doesn't eliminate the need for inspections, as which contract ends up sitting there is determined by the recently registered authorization.

Without Gas Authorization: Why signing on someone else's website is enough

The most dangerous part of EIP-7702 is its price. Authorization is a pure signature. It has no cost to you, does not appear in any fee summary, and you don't even need to submit it yourself: any third party can package it in their own transaction and cover the fee.

For honest providers, this is an advantage because new accounts can be used immediately without holding funds. For fraudulent websites, this is a gift. It does not require your transfers, approvals or account balance. One signature in a window that looks like a login, a free token declaration or a security check is enough.

This leads to a rule for daily use: treat any signature request for content that you cannot read as a transfer. This applies especially to requests that ask you to update, migrate or protect your accounts. You already know this technique from the classic form of manipulating payment recipients; how it works in the world has been covered in our August analysis of address poisoning.

Legal delegation: How to identify the real wallet account

It is wrong to conclude that every delegation is an attack. In addition to conspicuous targets, our measurements also revealed many attributable wallet contracts, including contracts from large browser wallet providers and some account templates in the abstract world of accounts.

In practice, three features quite reliably separate the two groups:

• The source code is publicly verified and has a name that matches the provider: In our window, this applies to 15 of the 55 target addresses. The lack of source code is not proof of any malicious behavior, but it is a reason to stop moving forward.
• Large contract size: Account templates weigh thousands of bytes because they bring signature checking, rights management, and interfaces. The conspicuous target in our measurement was less than 1,100 bytes.
• You triggered the delegation yourself: The wallet switching to the smart account will explain in advance and display the destination address. The commission you don't remember is a discovery.

People who frequently use multiple wallets should write down their provider's destination address once. Then the next check becomes a twenty-byte comparison instead of a research task.

Hardware wallets and blind signatures: Why devices don't automatically protect you here

A common misconception is that hardware wallets make this issue redundant. This is true for keys, but not for authorizations. The EIP-7702 authorization is also signed with a private key. In the worst case, the device only displays the target address and non-ce, without explaining the consequences to be drawn from it.

What matters then is whether your device renders the content of the signature request in plain text, and whether you have turned off signing unreadable data. What works here is explained in our article on blind signing of hardware wallets. The advice there remains the same: you don't sign what your device cannot display.

The second protection is the separation of duties. One account is used for daily dealings with apps, the second account is used to keep funds unchanged, and the second account is not signed on any website. Orders on daily accounts are annoying; orders on open accounts are expensive. If you need standardized technical wording, you can read it in the text of EIP-7702, especially the rule on chain ID zero.

How to check EIP-7702 delegation: Summary of key points

• Check the code field of the primary address today: Empty means you are okay. The string with the tag ef0100 means: Read the target address and look for it. Start with the address where the funds are actually held, and then select the device in the hardware wallet comparison to establish those positions.
• If you don't recognize the contract, don't send anything to that address again: Don't even send a cancellation fee. Consider the key lost, create a new account and process the rest through the white-hat hotline. Currently, anything you want to move to a safe place in the short term is better placed in an account with a regulated exchange than at an address where you have no control over its authorization; options for this are in our overview of cryptocurrency exchanges.
• Actively revoke intended but unused delegation: Only an authorization pointing to a zero target address can end a delegation, and only a null code field in the browser proves it is valid. People running multiple wallets in parallel should note down the destination address of their providers; which programs cleanly display this feature are covered in software wallet comparisons.

(As of September 13, 2026. This article does not constitute investment advice. Price and fee structures are subject to change; please check terms with your provider before purchasing.)