Externally Owned Accounts (EOAs) have been around since Ethereum genesis in 2015 and are the backbone of blockchain operations.

What are EOAs?

An EOA is a type of account on Ethereum controlled by a private key. It's how individual users interact with the blockchain. Think of a wallet - it's controlled by whoever holds the private key.

EOAs are in the core of Ethereum, they are how users interact with the network. Every action on Ethereum starts with an EOA.

It can send transactions and transfer ETH, but there's no smart contract code associated with it. The owner of the EOA needs to initiate actions by signing transactions.

An EOA is like your personal bank account, it serves the purpose of individual control, as opposed to a DAO which uses smart contract accounts to facilitate democratic collective governance.

Risks of EOAs

Of course, the biggest risks of EOAs is private key theft.

It's the most common attack in web3, happening through compromised servers, privacy breaches, social engineering, bribes and more.

Losing this key means permanent loss of both account access and any assets held within—there's no recovery mechanism. If an attacker obtains your key, they gain complete control over your account and can drain all funds without restriction.

Other risks are related to EIPs and token standards which allow EOAs to use.

What is EIP-7702?

Enter EIP-7702, a proposal introduced in 2024 bridges the gap between EOAs and more sophisticated smart contract accounts.

The idea is to allow any EOA to set its code based on any existing smart contract. The EOA owner authorises the smart contract with a signature and in this way the EOA mimics a smart contract account.

The EIP introduces “set code transaction”, where the TransactionType is 0x04 and the TransactionPayload is the RLP serialization of the following:

rlp([chain_id, nonce, max_priority_fee_per_gas, max_fee_per_gas, gas_limit, destination, value, data, access_list, authorization_list, signature_y_parity, signature_r, signature_s])

authorization_list = [[chain_id, address, nonce, y_parity, r, s], ...]

You can follow how each field is customizable based on your business case.

Risks with EOAs, EIP-7702 and EIP-4337

EIP-7702 is used by wallets such as MetaMask, Ambire, TrustWallet, PillarX and more.

This delegation can be a nasty rabbit hole, if security of the utilized smart contract accounts is not sufficiently researched.

Just recently, a vulnerable web3 wallet was used by a protocol on Binance Smart Chain, resulting in $300k stolen.

The contract had a an unprotected pancakeV3SwapCallback function which allowed anyone to ask for a “repayment” which is exactly what the exploiter did.

This means even if you've implemented all security best practises, code is audited and flow works perfectly, if you're delegating to external contracts with vulnerable functions - you're cooked.

A single vulnerable smart wallet could trigger losses of millions across the ecosystem. Be careful which 3rd party smart wallet contracts you trust.

Contact our security team for a detailed check of your implementation. ⛊

STAY SAFU

Audita's Team