What Is EIP-7702? How Do One-Signature Wallet Draining Attacks Work?

EIP-7702 is an account authorization standard that changes how Ethereum wallets can operate. It allows a traditional wallet address to use smart account features while keeping the same address, balance, and transaction history. It can enable conveniences such as batched transactions, sponsored gas, and advanced permissions, but it may also allow malicious actions to be combined into a single approval flow.

This is why the phrase “wallet draining with one signature” is often associated with EIP-7702. However, EIP-7702 is not a security vulnerability by itself, and not every EIP-7702 signature moves assets. The danger appears when a user approves a malicious authorization, account upgrade, or batched transaction without understanding what it will do.

What is EIP-7702?

EIP-7702 allows an EOA address to delegate execution to smart contract code that has already been deployed. EOA stands for “Externally Owned Account.” A traditional Ethereum account controlled with a seed phrase or private key in a wallet such as MetaMask is an EOA. Under normal conditions, an EOA does not contain its own programmable code.

After delegation, the wallet address does not change and the assets are not transferred to a new account. Instead, the account can execute selected contract code in the context of its own address. This allows the EOA to behave like a programmable smart account.

The standard introduces a “type 4” transaction that can include an authorization list. An authorization is a signed permission containing elements such as the chain ID, the contract address that will receive delegation, a nonce, and cryptographic signature data. Once processed on-chain, the account’s code field points to the delegated contract implementation.

An authorization is not automatically a command that says “send all tokens to the attacker.” It determines which code the account may execute. Transfers, approvals, and other actions can then be carried out through that code in the same transaction or in later transactions.

Why is EIP-7702 important?

Traditional Ethereum activity often requires several separate steps. For example, swapping a token may first require a token approval and then a second transaction for the swap. An EIP-7702-enabled account can combine these steps into one atomic transaction, meaning every action succeeds together or the entire sequence fails.

The standard can also allow another party to pay the gas fee, support bulk permission revocation, and enable more advanced account policies. Because users can gain these features without migrating to a new wallet address, EIP-7702 may accelerate the adoption of account abstraction technologies.

The same power can be misused. A legitimate application may safely package several actions, while an attacker may package several asset transfers into one malicious sequence. Security depends on the delegated contract, the information shown by the wallet, transaction simulation, and the user’s ability to verify what is being approved.

How does a one-signature wallet draining attack work?

The phrase “one signature” does not always mean that every wallet will display only one confirmation screen. Depending on the wallet software, the authorization and the transaction may be presented separately. Even so, EIP-7702 can allow malicious calls that previously required several independent approvals to be executed in one on-chain transaction.

A typical attack flow

1. A phishing page is created: The attacker builds a fake airdrop, NFT mint, staking, reward, or account verification website. Phishing is the practice of imitating a legitimate service to trick the user into approving an action.
2. The site requests a wallet connection: Connecting a wallet does not move assets by itself. The risk begins when the site presents a signature or transaction request after the connection.
3. An authorization request appears: The user is asked to sign an authorization that delegates the account to a contract chosen by the attacker. The request may be described as “enable smart account,” “upgrade your wallet,” or “activate advanced features.”
4. Malicious calls are bundled: ETH transfers, ERC-20 token transfers, NFT operator approvals, Permit signatures, or Permit2 permissions may be placed into the same batch.
5. The transaction is broadcast: The attacker or a relayer may pay the gas fee. Having no ETH in the wallet does not guarantee that the malicious transaction cannot be executed.
6. Assets are transferred: Once the malicious package is processed on-chain, multiple tokens, NFTs, and native assets may be sent to attacker-controlled addresses in the same transaction.

This type of malicious infrastructure is generally called a wallet drainer. A wallet drainer is a website, script, or attack kit designed to obtain misleading signatures or transaction approvals and use them to transfer assets. For a broader explanation, read What Is a Wallet Drainer?.

EIP-7702 authorization data does not include a natural protocol-level expiration time. The authorization is restricted by a nonce and becomes unusable when the relevant nonce is no longer valid. However, a signed authorization may still be submitted later while its conditions remain valid. A chain ID value of zero may also give the authorization broader applicability across multiple compatible chains.

If the private key or seed phrase has already been compromised, an attacker may use delegation to install code that automatically sweeps assets sent to the account in the future. In this situation, the original breach is the loss of the private key, while EIP-7702 gives the attacker a way to automate continued control.

How is this different from a token approval attack?

A token approval gives a specific spender contract permission to use a particular ERC-20 token. The tokens do not have to move at the moment the approval is granted. The spender may use the allowance later, up to the approved limit. For more details, see What Is Token Approval?.

A traditional approval is usually limited to one token contract and one spender. ETH, unrelated tokens, and NFTs are not automatically affected by that approval. The permission can normally be revoked for the specific token.

An EIP-7702 delegation is broader because it does not simply authorize spending for one token. It affects which code the account can execute. The delegated code may interact with multiple contracts, perform batched calls, and target different categories of assets in one sequence. This creates a wider account-level risk.

Even so, granting delegation does not guarantee that every asset will immediately be lost. The result depends on the delegated code and the execution request that is signed. Revoking a token approval does not remove an EIP-7702 delegation, and removing the delegation may not automatically cancel existing token or NFT approvals. Both layers must be reviewed separately.

What should users check on the signature screen?

A signature is a cryptographic confirmation created by the wallet’s private key for a message or transaction. A signature that requires no gas may still grant powerful permissions and may be submitted on-chain later by an attacker. “Free” does not mean “safe.”

If the wallet screen displays terms such as “account upgrade,” “enable smart account,” “set code,” “delegate account,” “authorization,” “batch execution,” or “multiple calls,” the request should not be treated like a simple login. Users should verify the following:

• Is the domain the official address of the application?
• Is the delegation contract published in the wallet provider’s official documentation?
• Do the network and chain ID match the intended blockchain?
• How many calls are included, which addresses receive assets, and what amounts are involved?
• Does the request include unlimited approval, Permit, Permit2, or setApprovalForAll permissions?
• Which token, NFT, or ETH balances decrease in the simulation?
• Does the wallet show raw data, an undecoded call, or a blind signing warning?

Users should open official applications through saved bookmarks rather than sponsored search results, social media advertisements, or shortened links. Delegation and target contracts can be reviewed with KipInCrypto Contract Check, but an automated score is not a security guarantee.

Transaction simulation shows potential balance and permission changes before approval. If the simulation displays multiple transfers to unfamiliar addresses, the request should be rejected. To understand simulation results, read What Is Crypto Transaction Simulation?.

I signed something suspicious. What should I do now?

Stop signing new requests and end all interaction with the suspicious website. Disconnecting the wallet is useful, but it does not revoke an existing authorization, delegation, or token approval.

If the transaction is still pending, replacing or cancelling it with a higher-fee transaction using the same nonce may sometimes work. However, users should not rely on this because attackers may use sponsored execution, private relays, or other broadcast methods.

Check the wallet’s EIP-7702 delegation management section. If an unknown delegation is active, use the wallet’s official “revoke,” “disable smart account,” or “reset delegation” process. At the protocol level, a delegation can be cleared by delegating to the null address, but users should prefer a verified wallet interface rather than constructing raw transactions manually.

Next, review ERC-20 approvals, Permit2 permissions, and NFT operator permissions separately. Revoke unknown spender and operator permissions on the correct network.

If the seed phrase, private key, backup file, or signing device may have been exposed, do not continue treating the old wallet as secure. Create a new wallet with a new seed phrase on a clean device, transfer any remaining assets, and review balances on every relevant network. Do not send new assets to the compromised address. If a sweeper bot may be active, sending gas without a carefully prepared rescue plan may give the attacker additional funds.

If assets have already moved, preserve transaction hashes, attacker addresses, screenshots, domain names, and communication records. If the assets reach a centralized exchange, contact the exchange through its official support channel and report the incident to the appropriate cybercrime authority. Blockchain transactions are generally irreversible, and no recovery can be guaranteed.

Security checklist

• Do not use a long-term storage wallet for routine dApp activity.
• Use a separate hot wallet with a limited balance for daily interactions.
• Treat smart account and delegation requests as high-privilege actions.
• Verify the delegation contract against official wallet documentation.
• Check token, NFT, ETH, and permission changes through simulation.
• Reject blind signing and undecoded raw data.
• Be cautious with unlimited approvals, Permit2, and setApprovalForAll requests.
• Review the chain ID, nonce, network, and scope of the authorization.
• Keep wallet software and browser extensions updated from official sources.
• Never share a seed phrase with a website, support agent, or verification form.

Frequently asked questions

Does EIP-7702 automatically make a wallet unsafe?

No. EIP-7702 is a legitimate Ethereum standard. The risk comes from malicious delegation, misunderstood batched transactions, phishing, or private key compromise.

Can an entire wallet be drained with one signature?

In some workflows, an authorization and multiple calls can be combined into a single approval flow or one on-chain transaction. However, not every EIP-7702 signature drains a wallet. The impact depends on the signed data and delegated code.

Is an authorization the same as a token approval?

No. A token approval gives a spender permission over a specific token. An EIP-7702 authorization determines which delegated code the account can execute.

Does disconnecting the wallet remove the permission?

No. Disconnecting a website does not revoke an on-chain delegation, token approval, or previously signed authorization.

How can an EIP-7702 delegation be removed?

Use the official revoke, disable, or reset option provided by the wallet. Avoid creating raw transactions through unknown tools.

If my seed phrase was exposed, is removing the delegation enough?

No. An attacker with the seed phrase or private key retains fundamental control and may create a new delegation. A new wallet with a new seed phrase should be created, and the old address should be abandoned.

Conclusion

EIP-7702 gives traditional EOAs access to batched transactions, sponsored gas, and programmable smart account features. The same capabilities may allow phishing sites and wallet drainers to combine several malicious actions into one execution package.

No authorization should be approved until the delegation address, network, call list, recipients, permissions, and simulation results are understood. After a suspicious signature, users should not stop at disconnecting the website. Delegation status, token permissions, NFT approvals, and private key security must all be investigated separately.