How to Use EIP-7702 Safely¶
This page explains what an EIP-7702 delegation authorizes and how to decide whether to sign one, so a feature you never asked for cannot take over your account.
Status on Bitgold
Bitgold does not document support for EIP-7702. Treat any delegation request as unverified until you have independently confirmed both the chain and the app behind it.
Who this is for¶
Read this if your wallet shows an EIP-7702, Delegate, Upgrade account, or "smart account" prompt, or if a site asks you to sign a delegation. If your wallet has never shown such a prompt, keep the refusal rule and move on.
Before you start¶
- Your wallet installed and unlocked, with an address on Bitgold mainnet (chain ID
618). - The explorer at www.bitgold.live open, so you can inspect that address.
- A memory of your normal transfer and approval screens, so you can recognize a request that is neither.
How it works¶
EIP-7702 is an Ethereum account-delegation feature. An ordinary account can point its code at a contract, so calls to that address run the contract's logic instead of the plain account's. The address and its balance stay the same.
Switching it on takes a delegation signature. That signature is not a payment and not a login. It authorizes a named contract to act for your account, and once it is on chain the contract does so under its own rules. If that contract can move tokens, upgrade itself, or hand control to an owner, then whoever controls those functions shares control of your account.
Turning it off is also a signed operation. A Revoke or Reset prompt asks for a second signature that points the account back to no delegation. It supersedes the first signature; it does not cancel it like a refund. A fake revoke page is therefore as dangerous as a fake delegation page.
The delegation belongs to the address on chain, not the wallet app. Reinstalling the wallet does not clear it; only a new signed delegation does.
What to do¶
- Confirm the chain first. Check that your wallet is on Bitgold mainnet, chain ID
618. A delegation signed on one chain says nothing about another, and a page can describe a network it is not using. - Name the contract. Ask for the target address and look it up on the explorer. If nobody can say what the contract does, there is nothing to evaluate.
- Separate a login from a delegation. A sign-in signature proves you hold the key. A delegation hands over how the account behaves. If a "verify your wallet" prompt carries a contract target, stop there.
- Find the undo before you agree. Locate the account-type or delegation control in your wallet and confirm it can return the address to a plain account. A switch you cannot reverse is a switch to decline.
- Refuse when support is unverified. No Bitgold setting, Console module, or support conversation enables EIP-7702, and no one can enable it for you.
Verify it worked¶
- The explorer shows no delegation target on your address, or exactly the target you approved.
- Your wallet lists the account as a standard address rather than a delegated account.
- A small transfer still produces the confirmation screen and address check you are used to.
Troubleshooting¶
| Problem | What to do |
|---|---|
| A delegation prompt appears after you opened a site you do not trust | Close the tab without signing, then open the wallet directly and check the account type. |
| You revoked, but the explorer still lists a target | Revoke again from the wallet's own interface and re-check the explorer. If the target remains, treat the account as exposed and move the balance. |
| A site claims Bitgold "now supports 7702" and offers one-click setup | Do not sign. Support is not documented, and an unsourced claim is the attack itself. |
| Your wallet greys out the revoke control | Move the remaining balance to an address you control that has never delegated. |
Next steps¶
- How to Check and Cancel Approvals — the same review habit, applied to token allowances.
- DApp Approval Scam — how a signature you did not read becomes a drain.
- How to Safely Use Custom Nodes — what an endpoint can show you while you sign.
Self-check¶
- I can name the contract address and the chain before I sign.
- I have found the revoke control in my wallet and know what it looks like.
- I have not signed a delegation to verify, upgrade, or unlock an account.
- I know a revoke is a second signature, not a reversal.