While EIP-7702 brings new convenience, it also introduces new risks Our Research team found that over 97% of all EIP-7702 delegations were authorized to multiple contracts using the same exact code. These are sweepers, used to automatically drain incoming ETH from compromised addresses. More insights from our @Dune dashboard ↓ What’s the “Crime” tag in our dashboard? These are mostly delegate contracts designed to auto-sweep funds from EOAs with leaked private keys. We highlighted this pattern in our original post, based on behavior seen across authorizations from compromised addresses. At that time, the bytecode was not verified. Now, we’ve reversed the EVM bytecode into Solidity and published a verified version called CrimeEnjoyor. Why verify it? Because verified code makes intent visible. We no longer need to infer malicious behavior from transaction patterns or metadata. This lets us: ‣ Shows exactly what the malicious contract does ‣ Add a public warning ‣ Clearly label it for other users The CrimeEnjoyor contract is short, simple, and widely reused. This one copy-pasted bytecode now accounts for the majority of all EIP-7702 delegations. It’s funny, bleak, and fascinating at the same time. It also reinforces a key point: New primitives like EIP-7702 expand what is possible, but without verification, labeling, and transparency tools, it becomes harder to tell infrastructure from exploitation, especially for new users. New updates to our dashboard We’ve added labels for delegate contracts used by: ‣ @TrustWallet ‣ Porto by @ithacaxyz ‣ @thirdweb ‣ v1 of @Uniswap Calibur ‣ @FireblocksHQ and more crime-tagged contracts With more compromised contracts tagged, more activity can be surfaced and more users can be protected. You can now also explore detailed activity analysis of EIP-7702 users on Ethereum, including which contracts they interact with. Currently, this covers only MetaMask workflow, and we’ve excluded any approve interactions to provide additional insights for the data. @Uniswap @JumperExchange @eulerfinance currently account for 95% of all EIP-7702 flows on Ethereum as they’re early integrators. 🔗 Check out the live EIP-7702 adoption metrics: h/t @FrankResearcher @emparedad0