You open Etherscan to check your wallet address and notice an extra section called "Authorizations." If this authorization was not made by you, or you cannot remember making it, it means someone may have gained some level of control over your wallet. At the very least, it means a delegation state exists.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Once an EIP-7702 delegation is set, it remains active until you actively clear it. Confirming who the delegation was granted to is key to determining whether your account is safe.
Minimum Viable Steps
Check three key pieces of information on Etherscan to judge whether the delegation state is under control. Follow these steps in order:
Step 1: Check the "Authority"
Open your wallet address page on Etherscan and find the "Authorization List" or "Authorizations" tab.
In the authorization list, find the "Authority" field. This address should be your wallet address. If this address is not yours, it means someone else has authorized a delegation relationship using a different address. This situation needs to be handled immediately.
Completion standard: The Authority field shows your own wallet address.
Step 2: Check the "Delegated Address"
In the same authorization list, find the "Delegated Address" field. This is the target contract address of the delegation, meaning the contract whose code your wallet is authorized to execute.
Safe situation: The delegated address is an officially published contract address from your wallet, or a protocol contract you have confirmed.
Danger signal: The delegated address is one you do not recognize, or it looks randomly generated.
After the Pectra upgrade, Etherscan launched a dedicated EIP-7702 authorization tracking feature. Users can see the current delegation and all historical authorization records on the address page.
Completion standard: You can identify the delegated address and determine whether it is a contract you trust.
Step 3: Check the Nonce
Look at the "Nonce" field in the authorization list. The Nonce is the transaction sequence number used by the EOA account when signing the authorization message. Its important role is to prevent the same authorization signature from being reused, known as a replay attack.
If the Nonce does not match your current account Nonce, the authorization may be old or forged. If you see the same Nonce across multiple chains in a cross-chain scenario, be aware that EIP-7702's chain_id = 0 mode may allow the authorization to be replayed across chains.
Completion standard: You can confirm the Nonce is reasonable, meaning at least you know it corresponds to your wallet's Nonce.
Troubleshooting
Case A: The delegated address is one you do not recognize
Do not delay. An EIP-7702 authorization does not expire automatically unless you actively revoke it. If you suspect a malicious delegation, revoke it immediately:
Send a new Type 4 transaction and point the delegated address to the zero address to clear the delegation.
Some wallets already support a one-click revoke feature. You can refer to the wallet's official guide.
Case B: You cannot find the authorization list on Etherscan If your address really has an EIP-7702 authorization, Etherscan will show the related records on the address details page. If you cannot see it, try:
Refreshing the page or using Etherscan's dedicated "Authorization List" page.
Using a third-party tool that supports multi-chain delegation state detection. You do not need to connect your wallet for this.
Case C: You confirm the delegation is official, but you want to limit its permissions If the delegated target is a trusted official contract, but you want to be more cautious, you can regularly check the authorization state in your wallet settings, or use a delegation contract that supports session keys and spending limits.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Verification and Wrap-Up
After completing the checks, you should be able to clearly answer these three questions:
Who is the Authority? — Is it your own address?
Which contract is the Delegated Address? — Is it an official contract you trust?
Is the Nonce normal? — Does it correspond to your current account Nonce?
How to verify completion: On Etherscan, confirm that the "Delegated Address" is a contract address you trust, and that the "Authority" is your own address. If the delegated address is suspicious, immediately revoke the delegation using the method above, and confirm on the block explorer that the delegation has been cleared, shown as the zero address or an empty authorization list.
