EIP-7702 enables programmable EOAs via Pectra upgrade

EOA functionality via delegation

The Pectra upgrade, which activated on May 7, 2025, allows Externally Owned Accounts (EOAs) to temporarily assume the behavior of smart contracts. This mechanism uses a new transaction type that includes an "authorization_list". Each tuple contains a chain ID, a contract address, a nonce, and an ECDSA signature. You already know the basics, so consider these technical details.

The network writes a delegation indicator to the EOA’s code.

This indicator uses the prefix 0xef0100 followed by the 20-byte contract address. The signature is a secp256k1 signature over the keccak256 hash of the magic prefix, chain ID, address, and nonce. This signature includes y_parity, r, and s elements. The authorization process increments the EOA’s nonce before execution begins, providing built-in replay protection. An authorization tuple costs 12,500 gas for existing accounts and 25,000 gas for accounts that have never been used. Within the first week of the upgrade, 15,000 EIP-7702 delegations appeared on Ethereum mainnet. This follows the activation of 4 million smart contract wallets in September. Traditional EOAs are lightweight but limited. They cannot respond to inputs like receiving tokens, they lack flexibility, and they cannot pay gas in anything other than the chain’s native token.

UX patterns and protocol differences

Wallet developers implement batching, gas sponsorship, and session keys to improve usability. Batching combines multiple operations, such as an ERC-20 approval followed by a swap, into one atomic transaction. Gas sponsorship enables users to pay for fees in tokens like USDC instead of native ETH. Session keys provide limited-use permissions that allow for specific actions without exposing the main private key. These features reduce transaction friction.

They complement each other.

EIP-7702 and ERC-4337 work together to improve the user experience. EIP-7702 onboards existing EOAs to the ERC-4337 infrastructure, including bundlers and paymasters. ERC-4337 provides a framework using UserOperations, an off-chain mempool, and bundlers to aggregate transactions. Bundlers must stake ETH in the EntryPoint contract to include these operations. While ERC-4337 relies on a specialized mempool, EIP-7702 uses the standard Ethereum mempool. This approach requires users to deploy a separate smart contract account at a new address, which adds complexity. A study by Wintermute Research found that over 97% of mainnet delegations in the first month pointed to a small number of contract families running similar sweeper bytecode.

How do developers handle storage collisions?

Implementation risks and security

Delegated contracts present new attack surfaces. If a contract lacks access controls, attackers can execute arbitrary logic to transfer tokens out of the wallet. Storage layout collisions happen when users change delegation contracts and encounter unexpected behaviors because a boolean variable in one contract might be interpreted as a uint in another. Adopting existing smart contract wallets built before EIP-7702 is dangerous because they lack support for initialization code or storage management.

The delegation does not include initialization code.

Because the delegation transaction does not include initcode, users must use initialization patterns to set state variables without being vulnerable to front-running attacks from malicious actors. If an attacker intercepts an authorization signature, they can execute the initialization function with different parameters to take control of the account. A single malicious delegation can lead to total fund loss.

The private key holds authority.

The delegation is reversible.

EIP-7702 provides the best method to upgrade existing users without requiring a full migration to new addresses.