EIP-7702: delegation deserves its own review

EIP-7702 allows an externally owned account to authorise a delegation designator pointing to code at another address. This is a different scope of action from a single token transfer. The delegate's implementation becomes central to understanding what the account can do.

Identify the destination code Record the delegation target, its implementation and the authorisation context. Determine how the delegated code authenticates subsequent operations. An application describing the action as an upgrade or convenience feature does not replace that review.

Examine recovery before accepting the change Ask how the delegation is changed or cleared and what permissions the implementation may have established separately. Clearing delegation should not be assumed to cancel unrelated token allowances or recover funds that have already moved.

Avoid misleading shortcuts Neither “gasless” nor “smart account” describes the complete trust model. An assessment should identify the exact authorisation, code and relevant limits. For a reported incident, distinguish the initial authorisation from later execution. Otherwise the timeline can incorrectly present the final asset transfer as the only decision that mattered.