URGENT: Ethereum Pectra Upgrade Enables Wallet Draining Attack via Offchain Signature

Attention, crypto users! The recent Ethereum Pectra network upgrade brought exciting new features, but it also introduced a serious vulnerability that could put your funds at risk. Experts are warning that attackers might now be able to drain wallets using just a simple offchain signature. This is a critical development that everyone holding ETH or tokens on Ethereum needs to understand.

What Did the Ethereum Pectra Upgrade Introduce?

The Pectra upgrade, which went live recently, includes several significant Ethereum Improvement Proposals (EIPs). While some, like EIP-7251 (increasing validator stake limit) and EIP-7691 (more data blobs for L2s), aim to improve scalability and staking flexibility, one specific EIP is causing concern: EIP-7702.

EIP-7702 introduces a new transaction type (0x04) that allows users to temporarily set code on their externally owned accounts (EOAs) by signing an offchain message. This is intended to enable smart account functionality for existing EOAs without requiring a complex migration. However, security auditors like Arda Usman and onchain researchers like Yehor Rudytsia from Hacken quickly identified the potential for misuse.

How Can an Offchain Signature Drain Your Wallet?

The core issue lies in the delegation capability introduced by EIP-7702. Here’s a simplified breakdown of the potential attack vector:

An attacker tricks a user into signing a specific type of offchain message (the EIP-7702 signature). This could happen via phishing sites, malicious DApps, or social engineering scams.
This signed message, when broadcast to the network as a type 0x04 transaction, allows the attacker to set code on the user’s wallet address.
The attacker sets a small, malicious proxy contract as the wallet’s code.
Once the code is set, the attacker can then interact with the user’s address as if it were a smart contract, executing calls to transfer ETH or tokens to the attacker’s address.
Crucially, this entire process, after the initial offchain signature, does NOT require the user to sign an onchain transfer transaction.

Arda Usman confirmed that this makes it possible to drain an EOA’s funds using only the offchain signed message obtained from the user.

Is Your Wallet Security at Risk?

According to experts, the threat is real and immediate since the Pectra upgrade is live. Wallets that were previously considered secure based on the assumption that EOAs could only be controlled by their private key signing onchain transactions are now potentially vulnerable. This includes:

Single-key hot wallets that don’t properly parse or warn about EIP-7702 signatures.
Hardware wallets are also now at risk if the user is tricked into signing a malicious EIP-7702 message, as the signature itself grants the delegation power. The security of the hardware wallet is bypassed if it signs the critical delegation message.
Smart contracts that rely on outdated checks like `tx.origin` or simply assume an address is an EOA without code.

Yehor Rudytsia emphasized that wallets are vulnerable if they do not analyze Ethereum’s transaction types, specifically the new type 0x04. Wallet interfaces need to clearly display delegation requests and flag suspicious addresses.

How Can You Stay Safe After the Pectra Upgrade?

Protecting your funds requires vigilance and understanding the new risks introduced by EIP-7702. Here are actionable insights:

Be Extremely Cautious About Signing Messages: Never sign a message unless you fully understand what it does. If a wallet prompts you to sign a message, read the details carefully.
Look for Delegation Warnings: Wallet developers need to update their software to detect and warn users specifically about EIP-7702 delegation signatures. Pay attention to any warnings your wallet provides.
Understand EIP-7702 Signature Format: These new signatures might appear as simple 32-byte hashes and don’t follow the older EIP-191 or EIP-712 standards. If a message includes your account nonce, it’s likely directly affecting your account’s state and should be treated with extreme caution.
Beware of `chain_id = 0`: EIP-7702 allows signatures with `chain_id = 0`, meaning the signature could potentially be replayed on any Ethereum-compatible chain. Understand that a signed message could have broader implications than just the network you’re currently interacting with.
Consider Multisig Wallets: Multisignature wallets offer better protection as they require multiple approvals for transactions, including setting code.
Stay Informed: Keep up-to-date with security advisories from your wallet provider and the broader Ethereum community.

This new attack vector, leveraging the offchain signature, is expected to become popular among attackers due to its effectiveness. Users must validate everything they are asked to sign with unprecedented care.

Conclusion: Vigilance is Key

The Ethereum Pectra upgrade represents a step forward for smart account functionality, but the implementation via EIP-7702 has created a significant new wallet security challenge. The ability to delegate control using just an offchain signature means users can no longer rely solely on the security assumptions of traditional EOAs or hardware wallets without careful message verification. Staying safe in this new landscape requires users to be highly skeptical of signing requests and for wallet providers to rapidly implement clear warnings and robust parsing for EIP-7702 signatures. Your awareness and caution are your first line of defense.