Standards

EIP-7702

EIP-7702 lets an externally owned account set delegated smart contract code while keeping its address.

EIP-7702 lets a normal wallet act more like a smart account.

EIP-7702 Explained in Detail

EIP-7702 adds a way for an externally owned account to use delegated code. The account keeps its address while calls execute logic from another contract, and that delegation can persist until replaced or cleared.

That changes a long-standing assumption: an EOA may behave like code during execution.

Smart contract example

EOA authorizes delegated code -> call executes account logic

Protocols that rely on "EOA means no code" need new review.

EIP-7702 in Auditing

EIP-7702 affects authorization, batching, replay protection, relayer flows, and contract-detection logic. Checks based on tx.origin, extcodesize, or contract allow/block lists may no longer mean what developers expect.

Auditors focus on what the delegated code can do in the account's context.

Red flags in code

  • Protocol assumes EOA callers cannot execute code.

  • Delegated wallet logic omits nonce, target, calldata, value, deadline, or domain checks for user actions.

  • Delegated code writes to storage without a stable layout.

  • Revocation or upgrade paths are unclear.

  • Batched actions bypass per-action checks.

How to test or review it

  • Model a user account that executes delegated code.

  • Check EIP-7702 delegation authorizations separately from application-level action signatures.

  • Check storage layout and revocation behavior.

  • Test protocols that block contracts but allow EOAs.

  • Review interactions with multicall and account abstraction flows.

Account Abstraction

Account abstraction lets smart contract accounts define their own validation rules instead of relying only on externally owned account transaction rules.

tx.origin

tx.origin is a Solidity global variable that returns the original externally owned account that started the transaction.

Delegatecall

Delegatecall executes code from another contract while reading and writing the caller's storage, preserving the original caller context.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like EIP-7702 into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources