eip7702-check: Full Guide to the Free Wallet Delegation Checker CLI

The eip7702-check tool answers the scariest security question of the Pectra era in one command: does this wallet carry an active 7702 delegation — and to whom? This is the author’s full guide: what the check reads, how to read the output, automation patterns, and where it feeds the revoke procedure. (Quick intro in the tools overview; the mechanism is explained in 7702 simply.)

What does eip7702-check actually do?

One read-only eth_getCode call to any public RPC. Under 7702, a delegated wallet’s “code” is a pointer: the 3-byte designator 0xef0100 followed by the delegate contract’s 20-byte address. The tool fetches your address’s code, parses the designator, and reports either clean (empty code) or delegated (with the delegate address to verify). No explorer scraping, no keys, no signature — the same on-chain state Etherscan’s “Delegated Address” field shows, scriptable.

Reading the output, line by line

Clean:

[OK] 0xabc...: no active EIP-7702 delegation (code is empty).
     Delegated Address on explorers should read: Null

Delegated:

[!] 0xabc... HAS an active EIP-7702 delegation.
    Delegated to : 0xdead...
    Action       : verify this contract on a block explorer.
                   Unknown contract → revoke via a type-0x04 tx

The critical judgment is yours: is 0xdead... a delegate you chose (your wallet app’s smart-account upgrade — see the legitimate uses) or an attacker’s sweeper (the October 2026 wave pattern)? Look the delegate up on a block explorer; labeled, expected contracts are fine — anything unknown is hostile and needs the revoke procedure.

Exit codes and automation

0 clean · 1 delegation found · 2 network error — built for machines, not just humans:

Cold-wallet monitoring (cron):

0 */6 * * * /usr/bin/python3 ~/eip7702-check/eip7702_check.py \
  --address 0xYourColdWallet || /usr/local/bin/alert_me "delegation on cold wallet"

Exit 1 fires the alert — a delegation appearing on a cold wallet between your checks is an incident, not a curiosity (sweepers act within minutes of top-ups — see the gas discipline).

Any chain, same command:

python3 eip7702_check.py --address 0xYourAddress --rpc https://polygon-rpc.com

Pectra shipped per-chain — check every chain your funds touch. The web checker covers the no-terminal case; Etherscan covers the manual case — three routes, one truth.

The cadence that matches the threat

Delegations attach at a signature you may not notice and activate when you deposit — sometimes weeks later. Practical cadence: after any wallet-connect interaction with an unfamiliar site (immediately), and monthly on wallets that hold anything meaningful (routine). If you run the post-incident checklist, this tool is step one of verification.

FAQ

Is eip7702-check free and safe? Yes — MIT, read-only, one RPC call, no keys or signatures. It cannot modify anything; its only output is information. The repo has install and usage.

The tool found a delegation I don’t recognize — what now? Treat it as hostile: stop depositing to that address, fund with only revoke gas (sweepers watch top-ups), send the type-0x04 revoke — the full procedure is in the walkthrough.

Can the tool tell me who delegated? It reports the delegate contract address; attribution (which app or attacker) is a block-explorer lookup — labeled contracts are usually legitimate wallet-app upgrades, unknown ones aren’t.

Does it work on Polygon/PolygonPoS and other chains? Yes — pass any chain’s public RPC with --rpc. Check each chain your funds touch; delegations are per-chain state.

Why did my clean wallet show delegation after using a dapp? Some legitimate wallet flows sign delegations (smart-account upgrades). If you recognize the delegate as your own wallet app’s contract, it’s expected — the judgment guide is in 7702 simply. If not, revoke.

Educational tool guide, not financial advice. Not affiliated with Polymarket. Last updated October 2026.