You sign an EIP-7702 authorization, thinking it only applies to the current chain. If the chainId is set to 0, the authorization may be replayable on all EVM chains, and your assets on every chain could be drained at once.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
First, understand what chain_id=0 means
The EIP-7702 authorization tuple includes a chain_id field that specifies which chain the delegation applies to.
When chain_id is a specific chain number, such as Ethereum mainnet 1 or Polygon 137, the delegation is only valid on that chain. If you check on another chain, the code field of your EOA is still empty, just as if no delegation had happened.
But when chain_id = 0, the situation is completely different. The EIP-7702 specification defines chain_id = 0 as a non-chain-specific authorization, meaning the delegation may take effect on all EVM-compatible chains. A peer-reviewed study on EIP-7702 phishing attacks clearly points out that this chain-agnostic mode can let a single phishing incident spread across chains.
Risk warning: After the Pectra upgrade went live, the SlowMist security team issued a warning reminding wallet providers to alert users about the risk of signing delegations with chainID 0, because such signatures may be replayed on different chains. If your delegated address is a malicious contract on chain B, a chain_id=0 authorization you signed on chain A may automatically take effect on chain B, without the attacker needing you to sign again on chain B.
Attack path explained: how chain_id=0 increases the risk
Here is a typical attack flow. Compare it with your own situation:
Step 1: Trick you into signing Scammers on Telegram, Discord, or phishing websites trick you into signing a message that looks like a login verification, airdrop claim, or cross-chain operation. Behind that message is actually an EIP-7702 authorization signature, and chain_id has been set to 0.
Step 2: Deploy on one chain, spread to many The scammer submits the authorization transaction on one chain, such as Ethereum mainnet, and delegates your wallet to a malicious contract. Because chain_id = 0, the scammer can submit the same signature again on any EVM chain and repeatedly deploy the same delegation.
Step 3: Drain assets Once the delegation takes effect, the attacker can call your wallet's transfer or transferFrom methods on any chain to move out ETH, all ERC-20 tokens, and NFTs on that chain. This delegation is also persistent, so it will not expire unless you manually clear it.
Right and wrong approaches compared
| Approach | Explanation |
|---|---|
| Wrong approach | Signing any unclear authorization or verification message on an unfamiliar website, assuming it is only valid on the current chain. |
| Right approach | 1. Directly reject any unknown message that asks you to sign an EIP-7702 authorization. 2. If you really need to sign, check the chain_id field in the signed message and reject any authorization with chain_id = 0. 3. Only operate through official wallet interfaces, and do not sign raw hashes that your wallet cannot parse. |
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
A checklist to check yourself
If you are not sure whether you have signed an authorization with chain_id = 0, follow these steps:
[What to do]: Check the delegation status on all EVM chains you have used and confirm that you have not been maliciously delegated.
[How to do it]:
Check delegation status chain by chain: Open the block explorer for each EVM chain, such as Etherscan for Ethereum, Polygonscan for Polygon, and Arbiscan for Arbitrum. Enter your wallet address and look for the "Authorizations (EIP-7702)" field under "More Info" or a similar section.
If you find an unexpected delegation address: Immediately send a new EIP-7702 type transaction (0x04) and set the delegation address to
0x0000000000000000000000000000000000000000, the zero address, to clear the delegation. You need to do this separately on each chain, and you need that chain's native token for gas.Confirm the clearing: On each chain's block explorer, confirm that the "Authorizations" field has disappeared or shows the zero address.
[Completion standard]: On all EVM chains you have used, the block explorers show the "Authorizations" field as empty or as the zero address.
How to verify the operation is complete: Enter your wallet address one by one on Etherscan, Polygonscan, Arbiscan, and other block explorers, and confirm that there is no unexpected delegation address in the "Authorizations (EIP-7702)" section. If any chain shows a non-zero address, clear it immediately using the steps above.
Next action: If you have ever signed any message related to cross-chain authorization or multi-chain signing, go check your delegation status now on the block explorers of all EVM chains you have used. This habit is far more useful than asking for help after something goes wrong.
