EIP-7702: Empowering EOA's, Expanding Attack Surfaces

Transcript

Hey, uh, hi dress. Uh, my name is Viraj. I'm a senior smart contract engineer at Camp Network. And today I'm going to be discussing extensively about EIP-7702. How has it, you know, empowered EOAs? And how has it, sort of, also expanded uh attack services on the other side of things. So, we just start off with a recap what we've seen in the space in the last few years. So, a lot of abstraction was introduced to simplify UX for crypto for different types of users with a retail or other DGen users so that we could get rid of the approved transactions when, you know, dealing with ERC-20 tokens or

things around, you know, like paying gas in different tokens, etc. Gasless transactions. And there are like the list goes on in terms of how, you know, we could, you know, get made the UX more much better than it was before. And we chronologically we started off with these three, you know, different EIPs and ERC standards that, you know, we've been sort of seen in the space. So, we started off with EIP-3074, which introduced two opcodes, auth and authcall. And that allowed full control, like a user to give full authority to the smart contract, you know, to do do the executions on its behalf. And then there were obviously

some security concerns with it because you were relying completely on the, you know, the on the contract and if a malicious contract or things like that happen, then your, you know, your wallet gets wiped out instantly. Then we had ERC-4337, which involved off-chain and on-chain components with user ops and a bundler, so we bundler to basically prepare the transactions using the user op structs. And then entry point contract where you you would send the user op structure the structure transaction. And the entry point would basically execute it on behalf of the user. And lastly, which is uh you know lastly but you know which is the most important one is EIP 7702 which is you know which we are using right now which

came with the Petra upgrade and the idea behind that was introducing a new transaction type where you would allow EOAs to attach a new delegator and that would do you know transactions on your behalf on a transactional basis and so it improved upon what 307 before you know came up with. Now we talked about the attack vectors and the adoption that EIP 7702 has seen. So in this chart you've seen this is the first attack vector which is pretty common which is again which I spoke about in the previous slide around you know just delegating to a malicious contract which is which can still happen because for example a layman user or a retail user sometimes doesn't verify the delegator that you know that you are basically

giving control to and in one click if you don't you know do your checks and verifications in that sense you know like decoding call data and things like that so you can just delegate to a malicious delegator and your entire you know wallet gets wiped out in one click. The second one is a bit more interesting which is around redelegations where if a user is you know is into like you know using different account like delegated contracts and they you know keep like they redelegate often to different delegator contracts then there can be a case where the storage slots differ and again which is which comes down to the previous issue where you don't verify the you know the the codes part of the delegators and the because of the

storage slots being different you there can be a you face issues when you know doing executions or things like that with these delegators. Now the we have this interesting Dune dashboard that was tweeted by Wintermute and as of yesterday as of 18th November in fact we have seen like there's been more than 5.5 million authorizations more than 2100 contracts we have seen you know more than 12 million addresses who have you know just used these delegators now the right chart is a bit more interesting where the orange part is around the malicious delegations that have been made which you can see is a lot right so that's is that's the point that I was speaking about that you need

to be very careful when you know interacting or delegating to a different to a delegator uh yeah and now this is the non-adoption part where we have seen that this is a website called 7702 beat which basically states the days since EIP 7702 has been live and these are the wallets or the daps that haven't adopted it yet and I believe it's not just and notable people have tweeted about it and I do I believe that it's not just about the attack vectors but it's about the narratives that that have been created in the space around meme coins or you know it's for agents inside of things things like that to and which also have more business profitability as well and that's why we've seen not seen this but I'm on the

bandwagon of people where you know I support it and I believe that everyone should support EIP 7702 so yeah thanks a lot and thanks a lot for listening in and I'll be around and if you want to have a chat around this yeah thank you >> [applause]