How to Check Whether Your Wallet Has an Active EIP-7702 Delegation and How to Revoke It

An EIP-7702 delegation is a signed authorization that makes your wallet address use the code of a smart contract. If you did not set one up yourself, or you signed something you do not remember, it is worth checking. This guide shows how to look for an active delegation, how to remove it, and what to do when removing it is not enough. If you are new to the topic, start with our explainer on what EIP-7702 is and how it differs from a token approval.

Step 1: Open your address in a block explorer

Use the official block explorer of the network you want to check, for example Etherscan for Ethereum. Paste your wallet address, not a transaction hash.

Type the explorer address yourself or use a bookmark. Fake explorers and search ads exist, so avoid reaching it through a link someone sent you.

Step 2: Look for delegation information

According to ethereum.org, an account's delegation can be detected by checking its code: a delegated address has code that points to the contract it is delegated to. Many block explorers now show this in some form, for example as a delegated-to address or as code on an account that used to have none.

Because explorer layouts change often, we cannot promise where this appears on every site. Check the explorer's own help pages if you cannot find it, and compare two explorers if the result looks unclear.

Step 3: Identify the contract

If a delegation exists, note the contract address it points to. Then ask:

• Did you knowingly enable a smart-account or "upgrade" feature in a wallet you trust?
• Does the contract address match the one published in that wallet provider's official documentation?
• Is the contract verified on the explorer, and does it have a history of normal use?

If the answer to the first question is no, treat the delegation as unwanted.

Step 4: Check every network you use

A delegation applies to one network unless it was signed with chain ID 0, which makes it valid on all of them, according to ethereum.org. Your address is the same on many EVM networks, so repeat the check on each network where you hold assets. Look especially at networks where you have used an unfamiliar app.

Step 5: Revoke the delegation

Ethereum.org states that a delegation can be reset by delegating to the null address. In practice this means sending a new authorization that points to the zero address.

• Use a wallet that supports resetting or removing delegations. Support differs between wallets and changes quickly, so check your wallet's official help pages.
• Expect to pay a network fee in the native token of that network.
• Repeat on each network where you found a delegation.
• After the transaction confirms, look at the address in the explorer again to confirm the change.

Do not follow instructions from a message or website that offers to "remove" a delegation for you. That is a common pretext for a second attack. Start from your own wallet's settings.

Step 6: Check token approvals separately

A delegation and a token approval are different things. Removing one does not remove the other. After you have dealt with the delegation, review the active allowances on your address with a reputable approvals checker and revoke those you do not recognise. Our guide to wallet safety when trading new memecoins explains how approvals work.

When revoking is not enough

Revoking only helps if the attacker does not control your private key. If you did not sign the delegation and it appeared anyway, or if funds have moved without your consent, assume your key or recovery phrase may be exposed.

In that case:

1. Create a new wallet with a fresh recovery phrase, on a device you trust.
2. Move your assets to the new wallet, starting with the most valuable ones. Keep in mind that automated bots can sometimes take any native token the moment it arrives on a compromised address, so plan how you will pay network fees.
3. Never reuse the old key, and do not store the new phrase in a screenshot, a cloud note or a chat.
4. Revoke approvals on the old address if you can, then stop using it.
5. Look for what exposed the key: a fake app, a pasted phrase, a malicious extension or an infected device.

Our article on wallet drainer links in memecoin communities shows one common way keys and signatures are lost.

If you want to check an address or contract you are unsure about, you can paste it into the free scanner on the ScamSonnar homepage. It is free and needs no sign-up.

Staying safe afterwards

Learn to recognise the requests that cause delegations in the first place. Our article on EIP-7702 phishing lists the warning signs.

Wallets, explorers and official guidance change quickly, so verify each step in the current official documentation of your wallet and the network before you act.

This article is for general information only and is not financial advice.