Skip to content

Add steps to check and clear an EIP-7702 delegation - #673

Open
mevdao-org wants to merge 1 commit into
security-alliance:developfrom
mevdao-org:add-7702-check-and-clear-steps
Open

mevdao-org wants to merge 1 commit into
security-alliance:developfrom
mevdao-org:add-7702-check-and-clear-steps

Conversation

@mevdao-org

Copy link
Copy Markdown

The page does a good job on the risks. What it doesn't cover is the question people ask right after a 7702 drain: is my address delegated, and how do I undo it? This PR adds two short sections for that.

The first shows how to read the account code with eth_getCode or cast code. A delegated EOA returns 23 bytes starting with 0xef0100, so it's easy to spot. It also says to repeat the check per chain, since an authorization signed with chain ID 0 can be replayed anywhere.

The second covers revoking. You sign a zero address authorization with cast wallet sign-auth and let a second, clean wallet broadcast it, so you never send gas into an account a sweeper is watching. I noted the nonce + 1 rule for self-broadcast too. There's also a warning that none of this helps if the key itself leaked.

Under Further reading I added the Foundry page for these commands and a longer walkthrough we wrote at MEV DAO. Drop ours if you'd rather keep that list to specs and tool docs, no problem.

Commands match the current Foundry docs. Formatting follows what's already on the page. I added mevdao-org to contributors.json and under wrote, since these are new sections. I'm with MEV DAO, so flagging that up front. Tagging @pinalikefruit as the page's steward. Happy to discuss it in frameworks-contribs too, or right here on the PR.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant