EIP-7702 Developer: EIP-7702 Itself Has No Vulnerability; Binance Attack May Involve Private Key Leakage or Abuse of Signed Authorization

TechFlow report, October 30: ZeroDev founder and EIP-7702-related developer Derek Chiang said EIP-7702 itself has no security vulnerability, and users of wallets that support the mechanism need not panic. EIP-7702 allows externally owned accounts (EOAs) to embed smart contract code into accounts by signing an authorization, enabling features such as transaction batching, but it could also be exploited by attackers to transfer account assets in bulk in a single transaction.

Derek Chiang pointed out that in the Binance attack, the attacker used EIP-7702 to transfer ETH, USDT, and 62 other tokens in a single transaction. To use this mechanism, the attacker must obtain access to the private key or induce Binance to sign an EIP-7702 authorization; the latter is less likely, but confirmation still awaits the official post-mortem investigation report.

He advised wallet developers and trading platforms not to expose EIP-7702 authorization or raw message signing interfaces to third parties, while users should prioritize using reputable wallets. In addition, he believes future EIP-8141 (Frame Transactions) may further improve account security through multisig contracts and transfer postconditions.

Source: TechFlow