{
  "object": "jepeta_content_article",
  "schemaVersion": "1.0.0",
  "id": "article.eip7702-wallet-delegation-security-checks",
  "contentType": "evergreen_guide",
  "title": "EIP-7702 Wallet Security: Check Delegation After a Failed Transaction",
  "slug": "eip7702-wallet-delegation-security-checks",
  "category": "wallet_security",
  "intent": "Help wallet users distinguish an EIP-7702 account delegation from a transaction outcome and identify checks before enabling or disabling smart-account features.",
  "directAnswer": "An EIP-7702 authorization can change the code an existing account executes. A failed subsequent call does not undo a processed delegation. Check the account, network and resulting delegation separately; use your wallet’s documented controls for changes, and do not assume a smart-account upgrade removes the original key’s authority.",
  "sections": [
    {
      "heading": "A familiar address can execute new account logic",
      "paragraphs": [
        "A smart-account upgrade deserves a different question from a token approval: what code will the account itself use? [MetaMask explains](https://support.metamask.io/configure/accounts/what-is-a-smart-account/) that its smart-account flow points an existing account to a contract without moving the funds or changing the address. Seeing the same address afterward therefore does not answer the security question. The relevant change is the account's execution behavior.",
        "MetaMask describes batching and sponsored fees among the capabilities smart accounts can enable. Its documentation also distinguishes general smart-account possibilities from features actually available in its wallet. Treat a feature list as a starting point for checking your particular account and network, rather than evidence that every listed protection is active."
      ]
    },
    {
      "heading": "Failure does not necessarily undo delegation",
      "paragraphs": [
        "[EIP-7702](https://eips.ethereum.org/EIPS/eip-7702) processes authorizations before the main execution. A valid authorization can install a pointer to delegated code; if execution later fails, processed delegation indicators are not rolled back. A failed transaction is therefore insufficient evidence that the account stayed unchanged. Check the account's resulting delegation on the relevant network. This is a protocol rule, not a report of a particular theft.",
        "The specification also treats changing delegated code as security critical. Delegate implementations need appropriate authorization and replay protection; changing implementations can introduce storage-compatibility problems. A wallet label cannot substitute for reviewing the implementation chosen by the wallet. This guide does not audit any delegate contract."
      ]
    },
    {
      "heading": "Look for account-state evidence",
      "paragraphs": [
        "[OpenZeppelin's account API reference](https://docs.openzeppelin.com/contracts/5.x/api/account#EIP7702Utils) documents `fetchDelegate`: it returns the delegate address for an account with EIP-7702 delegation, or the zero address otherwise. This is an account-state query, separate from a transaction's success status. It illustrates the evidence a wallet or inspection tool can expose; Jepeta did not run that function against a reader's account. A returned address identifies a delegation, not a security certification of its code."
      ]
    },
    {
      "heading": "Keep the signing key in the threat model",
      "paragraphs": [
        "[Ethereum.org's implementation guidelines](https://ethereum.org/roadmap/pectra/7702/) state that the original private key retains control after delegation. Pointing an account at a multisignature implementation does not, on its own, remove that key's authority. In other words, do not assume that a smart-account upgrade has neutralized an exposed recovery phrase.",
        "The guidelines recommend wallet-mediated interfaces instead of applications directly requesting arbitrary authorizations. For readers, the practical implication is to examine the wallet's supported flow and the implementation it permits. A request presented as an upgrade still needs a clear explanation of which account, network and behavior will change."
      ]
    },
    {
      "heading": "A review checklist before and after the switch",
      "paragraphs": [
        "This is an editorial checklist derived from the documentation, not a tested recovery procedure:\n\n| Check | Record | Stop when |\n| --- | --- | --- |\n| Account context | The account address and selected network | The request concerns a different account or network |\n| Execution logic | The wallet's documented implementation and purpose | The delegate is unexplained or the request contradicts the wallet's documentation |\n| Requested behavior | What the wallet says the action will enable | The requested authority is unclear |\n| Confirmed state | The resulting delegation, including after a failed call | The interface reports failure but account state is unresolved |\n| Exit route | The wallet's documented way to disable the feature | You cannot identify a supported way back |\n\nKeep the observations separate. Understanding a requested feature does not establish that its implementation is correct."
      ]
    },
    {
      "heading": "Use the wallet’s documented exit route",
      "paragraphs": [
        "[MetaMask's switching guide](https://support.metamask.io/configure/accounts/switch-to-or-revert-from-a-smart-account) describes disabling smart-account functionality from the account's settings, per network, followed by transaction confirmation and a network fee. Follow the current instructions inside the official wallet rather than an unsolicited upgrade or recovery link. MetaMask says its account upgrades are managed in the wallet and that it will not email you to perform one.",
        "Disabling a feature is not proof that every other permission or account risk has been resolved. Review [token allowances](/articles/token-approval-hygiene-guide/) separately, and keep the selected network explicit with the [chain-context checklist](/articles/recheck-chain-after-network-change/). This article is a comparison of published specifications and product documentation. No wallet was connected, no recovery transaction was attempted, and no hardware device or contract was security tested."
      ]
    }
  ],
  "sources": [
    {
      "id": "eip7702",
      "label": "EIP-7702: Set Code for EOAs",
      "url": "https://eips.ethereum.org/EIPS/eip-7702",
      "sourceType": "primary",
      "publishedAt": null,
      "verifiedAt": "2026-10-21T18:03:16.991Z"
    },
    {
      "id": "metamask_switch",
      "label": "MetaMask: switch to or revert from a smart account",
      "url": "https://support.metamask.io/configure/accounts/switch-to-or-revert-from-a-smart-account",
      "sourceType": "primary",
      "publishedAt": null,
      "verifiedAt": "2026-10-21T18:03:16.991Z"
    },
    {
      "id": "metamask_explainer",
      "label": "MetaMask: smart-account capabilities and limits",
      "url": "https://support.metamask.io/configure/accounts/what-is-a-smart-account/",
      "sourceType": "primary",
      "publishedAt": null,
      "verifiedAt": "2026-10-21T18:03:16.991Z"
    },
    {
      "id": "ethereum_guidelines",
      "label": "Ethereum.org: EIP-7702 implementation guidelines",
      "url": "https://ethereum.org/roadmap/pectra/7702/",
      "sourceType": "primary",
      "publishedAt": null,
      "verifiedAt": "2026-10-21T18:03:16.991Z"
    },
    {
      "id": "openzeppelin_api",
      "label": "OpenZeppelin Contracts: EIP7702Utils account-state reference",
      "url": "https://docs.openzeppelin.com/contracts/5.x/api/account",
      "sourceType": "primary",
      "publishedAt": null,
      "verifiedAt": "2026-10-21T18:05:32.337Z"
    }
  ],
  "sourceDates": [
    {
      "sourceId": "eip7702",
      "publishedAt": null,
      "verifiedAt": "2026-10-21T18:03:16.991Z"
    },
    {
      "sourceId": "metamask_switch",
      "publishedAt": null,
      "verifiedAt": "2026-10-21T18:03:16.991Z"
    },
    {
      "sourceId": "metamask_explainer",
      "publishedAt": null,
      "verifiedAt": "2026-10-21T18:03:16.991Z"
    },
    {
      "sourceId": "ethereum_guidelines",
      "publishedAt": null,
      "verifiedAt": "2026-10-21T18:03:16.991Z"
    },
    {
      "sourceId": "openzeppelin_api",
      "publishedAt": null,
      "verifiedAt": "2026-10-21T18:05:32.337Z"
    }
  ],
  "originalEvidence": [
    {
      "type": "structured_comparison",
      "description": "Compared protocol delegation/failure behavior, OpenZeppelin account-state inspection, Ethereum.org key authority and MetaMask account controls; derived a context/implementation/result/exit checklist distinct from token-allowance guides. No incident investigation or wallet test is claimed.",
      "url": "https://eips.ethereum.org/EIPS/eip-7702",
      "observedAt": "2026-10-21T18:03:16.991Z"
    }
  ],
  "datePublished": "2026-10-21T18:03:16.991Z",
  "dateModified": "2026-10-21T18:06:07.896Z",
  "reviewedAt": "2026-10-21T18:06:07.896Z",
  "affiliate": {
    "enabled": false,
    "partnerId": null,
    "linkId": null,
    "disclosureRequired": false,
    "rel": null
  },
  "disclosure": "AI-assisted educational explanation based on the cited primary documentation. Source inspection and editorial review were separate passes by the same AI workflow. No wallet, hardware device or recovery transaction was tested. No affiliate links.",
  "internalLinks": [
    "/articles/token-approval-hygiene-guide/",
    "/articles/recheck-chain-after-network-change/",
    "/methodology.html"
  ],
  "telegramCohort": {
    "surface": "article",
    "cohortId": "article"
  },
  "format": "markdown",
  "seoTitle": "EIP-7702 Security: Check Wallet Delegation After Failure",
  "metaDescription": "A failed call can leave EIP-7702 delegation installed. Compare account logic, key authority and MetaMask controls before changing smart-account settings.",
  "heroImage": {
    "src": "/articles/assets/eip7702-checks/eip7702-checks-1600.png",
    "width": 1600,
    "height": 900,
    "sha256": "df8a2a23e03ee9165ce955234d81856551a95a6f2d6ed97ebf5a7265923fe124",
    "alt": "Original EIP-7702 checklist diagram: verify account and network, delegated code, and state after execution",
    "rights": {
      "status": "owned",
      "kind": "original_diagram",
      "credit": "Jepeta editorial: original documentation-based instructional diagram"
    },
    "variants": [
      {
        "src": "/articles/assets/eip7702-checks/eip7702-checks-960.png",
        "width": 960,
        "height": 540,
        "sha256": "fe50361724bbd71affb9b26dacc4aecd45a3b602787a65176b96fad8b0237c1c"
      },
      {
        "src": "/articles/assets/eip7702-checks/eip7702-checks-640.png",
        "width": 640,
        "height": 360,
        "sha256": "d382b84eba31587be3ee5f8d61d5aa96f921167e3ec1e6956cbabbc5a06c787f"
      }
    ],
    "provenance": {
      "createdAt": "2026-10-21T18:03:16.991Z",
      "tool": "Pillow original vector-like instructional layout",
      "sourceSha256": "4b2384cbd7231d4eb7c4dc9fb2fcf33141f78bba91147dfc8791f85ffacb2ceb"
    }
  },
  "quality": {
    "decision": "publish",
    "citabilityScore": 100,
    "reviewedAt": "2026-10-21T18:06:07.896Z",
    "policyVersion": "1.0.0"
  },
  "canonicalUrl": "https://jepeta.dev/articles/eip7702-wallet-delegation-security-checks/",
  "jsonUrl": "https://jepeta.dev/articles/eip7702-wallet-delegation-security-checks/index.json"
}