EIP-7702 vulnerability exploited, attacker siphons off 95 ETH into a mixer

【BitPush】Just reported a contract security incident. An attacker exploited an uninitialized EIP-7702 delegate contract vulnerability, successfully gaining owner permissions of the contract, and then directly withdrew all funds from the delegate address. On-chain monitoring data shows that the attacker has transferred 95 ETH (approximately $280,000) to Tornado Cash for mixing.

The key issue in this incident is the initialization flaw in the EIP-7702 delegate contract—because the contract was not properly initialized during deployment, the attacker was able to seize the owner role at a very low cost. Once controlling the owner permissions, withdrawing funds became a trivial task. After the funds were transferred to Tornado Cash, tracking them became significantly more difficult.

This serves as a reminder for developers to ensure the completeness of the initialization process when deploying delegate contracts, to prevent attackers from exploiting vulnerabilities. For ordinary users, it’s advisable to check whether new contracts have undergone security audits before interacting with them.