GoPlus Security 🚦 (@GoPlusSecurity): ⚠️Warned: EIP-7702 Delegation Risk Exposes Contracts to Hijacking, Check Now

⚠️Warned: EIP-7702 Delegation Risk Exposes Contracts to Hijacking, Check Now Recently, GoPplus Security analyzed multiple smart contract exploits where hacker groups have leveraged the features of EIP-7702 to bypass security checks (msg.sender == tx.origin ,msg.sender == _owner, and etc.). This enabled unauthorized contract executions and flash loan attacks, causing >$1M losses. Despite pre-implementation warnings, our research shows numerous on-chain contracts remain vulnerable to these exploits, including prominent DeFi projects. We urge immediate security checks. Case 1: Bypassing EOA-Only Access Control for Flash Loan Attack Attack Transaction: https://polygonscan.com/tx/0x60d5292aa5dfcc074e0b97d31c919f09bd282c24e138b7079484cf87d5ab11cc Attacker Address: 0x4ccd02690d32e2512fc99dfd837972597e522c2b Malicious Delegator: 0xc4b57D53fcfe5990b950b43915b747f55A6fde03 Attack Contract: 0xf1e80c57f6755d5d218af1716bd2f722a47ac3c1 Targeted Contract: 0x44574d53474729f2949a7ecfb68b0641cfda4aa8 (QuickConverter @QuickswapDEX) ⚡️Attack Flow 1. Flash loan of 1,000 WPOL + 10.7M MaticX → Used MaticX as collateral to borrow 5.1M WATIC → Swapped WATIC for 1.29M QUICK 2. The attacker’s address (0x4ccd) authorized the malicious delegator (0xc4b5) to invoke its execute(), which in turn called the convert function of the targeted contract (0x4457). 3. Attacker's EOA (0x4ccd) authorized malicious delegator (0xc4b5) to execute `convert()` on QuickConverter contract (0x4457). The contract's EOA execution guard (`msg.sender == tx.origin`) was bypassed via EIP-7702's delegator contract. Case 2: Contract Ownership Hijacking for Price Manipulation Transaction Hash: https://bscscan.com/tx/0x580f504af22ba7626fbf773bec7ef9d3b6732d307800abbd7fa793f6f5c36e94 Malicious Delegator : 0xBbCdBB3B180C2a90D928b91A2D4fB1a5d9472650 Attack Contract：0x37ee5b125c4e5fd1f88fb5ab5e27b36c942447c8 Targeted Contract: Multiple CSM-related liquidity pools (e.g., 0xf592f5f98ead5ed6a1a22aca3233ae1e0ac6184c) ⚡️Attack Flow 1. The attacker obtained a flash loan of 770,000 USDT. 2. By repeatedly calling botsSellCSM (0x945d9a5) in LP contract (0xf592), the attacker dumped CSM for USDT, artificially crashing the CSM price at no cost. 3. Attacker bought CSM at depressed price using flash-loaned USDT 4. Re-invoked botsSellCSM(0x945d9a5), using the pool’s USDT to repurchase CSM, driving the price back up without additional expenditure. 5. The attacker sold the low-cost CSM acquired in step 3, profiting from the price swing, repaid the flash loan, and walked away with the gains. Exploit vector: Attacker compromised contract owner (0x52f4) who had authorized malicious EIP-7702 delegator (0x37ee), bypassing `msg.sender == _owner` check. 🔖GoPlus Security Recommendations 1. Deprecate EOA-dependent logic: Replace with time-delayed operations and invariant checks 2. Harden reentrancy protection: Implement a rigorous "checks-effects-interactions" pattern and deploy reentrancy guards to block recursive exploits. 3. Redesign access control: Traditional EOA checks and access controls are largely ineffective post-EIP-7702. Overhaul and reimplement these mechanisms in contracts. 4. Monitor delegator authorizations: Regularly audit admin address 7702-delegator settings to thwart phishing attacks or supply chain compromises.