How to Check If Your Wallet Has an EIP-7702 Delegation (And Revoke It Safely)
A wallet with a malicious EIP-7702 delegation can be emptied by a sweeper bot minutes after you top it up — without you signing anything. Checking takes two minutes, costs nothing, and works for any EVM address. Here is the complete procedure: read the delegation status, interpret what you see, and revoke safely if something is wrong.
Step 1: Look up your address on a block explorer
Open Etherscan (or the equivalent explorer for your chain) and paste your address into the search bar. On the address page, find the “Delegated Address” field — Etherscan surfaces it in the account summary for any address carrying EIP-7702 state. If you don’t see the field at all, the address has no delegation and you’re clean on this axis.
Step 2: Interpret the three possible readings
“Null” — no active delegation. The address has never delegated or the delegation was cleared. Nothing to do.
A labeled contract from a wallet you knowingly upgraded. If you (or your wallet app) upgraded to a smart-account implementation — Passkey wallets, some embedded wallets — you’ll see a recognized implementation name. This is expected. Verify the label matches what you actually opted into.
An unknown contract address. This is the danger state. An attacker who phished a 7702 authorization out of you delegated your account to a sweeper contract, and anything you send there can be swept. An unknown label with a transaction history you don’t recognize means: stop using this address until you’ve revoked.
Step 3: Revoke (only if you’re sure your key is uncompromised)
Revoking a delegation means sending a type-0x04 transaction that re-delegates the account — the standard route is delegating back to the canonical EOA indicator (the “Null” state). Practical routes:
- Wallet-native: recent MetaMask, Rainbow and most major wallets expose “remove delegation” or “reset smart account” actions that build the 0x04 transaction for you.
- Manual: construct a type-0x04 transaction with the authorization
tuple pointing at the null-designator contract (
0xef01-prefixed indicator address on mainnet). Tools like our delegation checker show the current state so you can verify the revoke landed.
Critical ordering detail: the revoke transaction itself costs gas, and if a sweeper is watching the account, it may race you. Fund the compromised address with only the gas needed for the revoke — nothing more — send the revoke, verify the “Delegated Address” reads Null, and only then consider the address usable again. If your seed phrase itself was phished, revoking the delegation is not enough: the attacker holds the key. Move everything to a fresh wallet with a new seed — see the first 24 hours after a drain.
Step 4: Verify and re-check your habits
After the revoke, re-read the Delegated Address field — it must show Null. Then check what let the attacker in:
- Did you sign an authorization request you didn’t initiate? That’s the classic one-signature drainer pattern.
- Do you have unlimited token approvals still active? Those outlive delegation cleanup — audit them separately.
- Use a hardware wallet or clear-signing wallet for anything holding real value; blind-signed typed data is how most 7702 phishes land.
FAQ
How do I check if my wallet has an EIP-7702 delegation? Open your address on Etherscan and read the “Delegated Address” field: Null means none, a labeled contract you chose is expected, an unknown contract means revoke.
What does “Delegated Address: Null” mean? Your account is a normal EOA with no active delegation — the safe state.
Can I remove a malicious delegation myself? Yes, with a type-0x04 transaction re-delegating to the null indicator. Wallets increasingly offer this as a one-click action. Fund the address with only the gas needed — sweepers may be watching.
I revoked but my funds were already swept — what now? The delegation was the persistent backdoor; funds swept before the revoke are gone absent recovery action. Never pay unsolicited “recovery agents” — most are second-wave scammers.
Is an unknown delegation dangerous if I never send funds there again? The account stays a liability: any accidental deposit can be swept, and the delegation can interact with approvals you forgot. Revoke or abandon the address entirely.
Educational content, not financial advice. Read-only guidance; never share your seed phrase with any checking tool. Last updated October 2026.
