7702 Reality Check

EIP-7702 doesn't log signers, only sponsors. We recovered 18,105 signing wallets over 3k blocks: 83% of volume is industrial bots, while 84% of the ETH is organic. Reproduce it with a public RPC

Comment

7702 Reality Check — Hackathon Submission

Inspiration

When EIP-7702 went live on Ethereum, social media and industry dashboards quickly began reporting millions of "delegations" and sounding the alarm on massive "delegation epidemics" and compromised wallets.

I did my research and noticed a fundamental flaw in how the ecosystem was interpreting this data: people were counting transactions and authorization tuples as if they were unique users. In EIP-7702, type-4 transactions carry an authorizationList, but tx.from is merely the gas sponsor or relayer, never the signing authority. Furthermore, automated bots sign thousands of delegations repeatedly. I built 7702 Reality Check to run the raw cryptography over Ethereum mainnet, separating vanity transaction metrics from actual human adoption and capital exposure.

What it does

7702 Reality Check is a forensic measurement pipeline and interactive dashboard that determines whether EIP-7702 delegation volume on Ethereum mainnet comes from real accounts or automated bot pools. Rather than querying pre-aggregated third-party feeds, it cryptographically recovers every signing authority across 3,000 contiguous mainnet blocks (blocks 26,018,045 to 26,021,045).

Key Empirical Findings:

  • 33,771 authorizations stem from only 18,105 distinct signing wallets (global re-delegation ratio of 1.87×).
  • Volume and money sit on opposite sides of the dataset:
    • Single-operator contracts (1–5 relayers): Account for 83.32% of all authorizations, yet only 1.00% of sampled wallets are funded (holding 10.46 ETH total).
    • Organic contracts (15+ relayers): Account for just 12.35% of volume, yet 28.96% of wallets are funded, holding 55.20 ETH (84.02% of all capital).
  • 28.9× Real-Money Separation: Relayer diversity directly predicts funded user presence. High volume merely indicates industrial automation.
  • Labels behaviour, never intent: Zero arbitrary "threat scores" (0–100). Every classification (single-operator, mixed-relayers, organic) is strictly bounded by verifiable on-chain evidence.

How I built it

  • Cryptographic Recovery Engine: Built in Node.js 22 (ESM) using viem. For each authorization tuple, the pipeline reconstructs the EIP-7702 payload and recovers the authority address via ECDSA secp256k1 over the digest: $$\text{digest} = \text{keccak256}\Big(0\text{x}05 \parallel \text{rlp}([chainId, address, nonce])\Big)$$ Recovering 33,771 tuples with 0 recovery failures.
  • Global Deduplication & Signal Matrix: Evaluates relayer diversity, median account nonces, global union sets, and live balance snapshots.
  • Zero-Credential Reproducibility: No API keys, no proprietary backends, and no wallet connection required. The entire measurement regenerates deterministically via public JSON-RPC (npm run measure).
  • Dashboard Architecture: React 19, Vite 8, and Tailwind CSS v4. Features a bimodal distribution visualization and a real-time delegation feed powered by a background Web Worker to keep secp256k1 signature recovery off the UI main thread.
  • Single Source of Truth: UI components, meta tags, and the generated social card (public/og.png) read directly from data/artifact.json.

Challenges I ran into

  • The Missing Signer: EIP-7702 authorization tuples contain [chainId, address, nonce, yParity, r, s]—the authority is nowhere in the payload. Standard block explorers either lacked type-4 filters or pre-aggregated away raw tuples. I had to stream raw blocks directly from JSON-RPC and recover public keys in batches.
  • The Double-Counting Pitfall: Naive per-contract summation double-counts addresses delegating to multiple contracts, inflating wallet figures by 34.24% (24,305 vs. the true global union of 18,105).
  • Preserving Window Contiguity: Strided block sampling collapses the re-delegation ratio down to 1.00×, blinding the pipeline to bot activity. I had to enforce strictly contiguous block scans while respecting free public RPC rate limits.
  • Thread Starvation in the Browser: Running cryptographic ECDSA recovery on live mainnet streams in the browser caused frame drops. Offloading recovery into dedicated Web Workers restored a locked 60 FPS.

Accomplishments that I'm proud of

  • 100% Cryptographic Integrity: Zero failed recoveries across 33,771 tuples.
  • Uncompromising Reproducibility: Any reviewer can clone the repository and run npm test offline (fixture-driven) or npm run measure live without creating an account or providing an API key.
  • Debunking the "Epidemic" Myth: Proving with mathematical rigor that 83% of the volume represents automated address farms (like a single address re-signing 1,379 times with nonce ~487k), while legitimate funds reside in organic multi-relayer contracts.

What I learned

  • Volume is an inverted proxy for capital exposure: In emerging smart contract wallet primitives, transaction count frequently measures bot loop churn rather than user adoption.
  • Engineering discipline over hype: Unsampled metrics must remain null, never coerced to 0. If a hypothesis is disproven by new data (such as a previously assumed empty relayer band), the claim must be retracted honestly rather than rationalized.

What's next for 7702 Reality Check

  • Sliding-Window Temporal Monitors: Expanding the pipeline into continuous tracking to monitor shifting relayer patterns over extended time horizons.
  • L2 Forensic Rollout: Porting the measurement pipeline to Layer 2 ecosystems (Base, Arbitrum, Optimism) where EIP-7702 adoption is accelerating.
  • Pre-Flight Wallet Check API: Packaging the behavioral heuristic into an open-source lightweight library so wallets can alert users before signing delegations to contracts with single-operator / zero-balance profiles.

Built With

Share this project:

Updates

Submission history