Briefing
The EIP-7702 protocol, designed to enhance Ethereum Externally Owned Accounts, has been exploited, leading to over $5.3 million in user fund losses. Attackers leveraged malicious delegator contracts to execute signature phishing and unauthorized upgrades, bypassing standard on-chain security checks. This incident highlights a critical vulnerability in how EIP-7702 grants smart contract capabilities, enabling sophisticated fund siphoning from compromised wallets. The InfernoDrainer group notably utilized EIP-7702’s batch execution feature within MetaMask to consolidate multiple malicious transactions, resulting in significant asset drains.
Context
Prior to this incident, the EIP-7702 protocol was envisioned to empower EOAs with smart contract functionalities, yet its implementation introduced a novel attack surface. The inherent complexity of delegator contracts, coupled with their ability to bypass traditional msg.sender and tx.origin checks, created a fertile ground for sophisticated exploits. This class of vulnerability was exacerbated by insufficient scrutiny of how delegated permissions could be abused, making wallets susceptible to unauthorized actions.
Analysis
The attack vector exploited EIP-7702’s delegator contract mechanism, specifically targeting Ethereum-based wallets, including MetaMask users. Attackers initiated signature phishing campaigns, tricking users into authorizing malicious delegator contracts. Once authorized, these contracts facilitated privilege abuse and unauthorized upgrades, allowing the attacker to execute transactions that bypassed fundamental on-chain security validations. The InfernoDrainer group demonstrated this by consolidating multiple malicious operations into a single, seemingly legitimate authorization via EIP-7702’s batch execution, effectively draining user assets.
Parameters
- Protocol Targeted → Ethereum (EIP-7702)
- Attack Vector → EIP-7702 Delegator Contract Exploitation, Signature Phishing
- Financial Impact → $5.3 Million
- Affected Wallets → MetaMask Users
- Threat Actor → InfernoDrainer Group
- Mitigation Implemented → GoPlus EIP-7702 Attack Detection Plugin
Outlook
To mitigate immediate risks, users must prioritize private key protection and rigorously avoid delegator authorizations from unverified web pages. Wallet providers are strongly advised to adopt robust security frameworks, such as restricting delegator authorization to in-app operations and enhancing transaction metadata transparency to counter phishing attempts. This incident will likely drive new auditing standards for EIP-7702 implementations, particularly focusing on flash loan and reentrancy attack scenarios, to prevent future systemic contagion within the DeFi ecosystem.
Verdict
The exploitation of EIP-7702 delegator contracts represents a significant evolution in phishing tactics, necessitating immediate and comprehensive security enhancements across Ethereum’s wallet and DeFi infrastructure.
