Skip to main content

What Is EIP-7702, and Why Does Gem Wallet Warn About Delegated Wallets?

What Is EIP-7702?​

EIP-7702 is an Ethereum upgrade, part of the 2025 Pectra upgrade, that lets a regular wallet address run smart contract code. The owner signs an authorization that points the address to a contract. After that, the address is delegated: it keeps the same address and the same private key, but transactions to it can run the delegated code.

It works on Ethereum and on EVM networks that adopted the upgrade.

Legitimate uses include:

  • Batching several actions, such as an approval and a swap, into one transaction.
  • Sponsored fees, where an app pays the network fee for you.
  • Smart account features, such as spending limits or session keys.

How Scammers Misuse It​

Delegation is powerful, and the person who chooses the code controls what the address does:

  • Drainer delegations: a scam site tricks someone into signing an authorization that points their address to a malicious contract. That code can move funds out of the wallet.
  • Sweeper wallets: after stealing a Secret Phrase, a thief delegates the wallet to code that instantly sweeps away anything sent to it, including the ETH the owner sends to pay fees.
  • Delegated spenders: a scam asks you to approve tokens to an address that looks like a regular wallet but runs delegated code, or is simply controlled by the scammer.

How Gem Wallet Protects You​

  • Gem Wallet doesn't sign delegation requests from dApps. A website connected through WalletConnect can't ask Gem Wallet to delegate your account.
  • Approval warnings: when a dApp asks you to approve tokens or sign a permit, and the spender is a regular wallet, including one running delegated EIP-7702 code, Gem Wallet shows an Externally Owned Spender warning. Approving a wallet instead of an app's contract is how drainers take tokens, and a delegated wallet can still be moved by whoever holds its key. See How to Review a Transaction Simulation.
  • Flagged addresses: spenders and recipients known to be malicious are blocked before you can confirm.
warning

If you see an Externally Owned Spender warning and you didn't expect it, reject the request. A real dApp almost always asks you to approve its own contract, not a wallet.

If funds leave your wallet right after they arrive, or a block explorer shows your address as delegated to a contract you don't recognize, assume your wallet is compromised:

  1. Don't send more funds to it, not even ETH for fees. A sweeper will take it.
  2. Create a new wallet in Gem Wallet with a new Secret Phrase.
  3. Move anything that's left from the old wallet to the new one, if you still can.
  4. Revoke token approvals on the old address. See How to Revoke a Suspicious Token Approval.
  5. Follow What to Do If Your Secret Phrase Is Exposed and How to Report Scams.

Undoing a delegation needs a new authorization signed with the same key. If someone else has your key, they can delegate again, so a new wallet is the only safe fix.