EIP7702 Goat

Intentionally flawed code with potential pitfalls in custom contracts for EIP-7702 delegate accounts.

Use this repository to learn about 7702 in a practical way. Tweak the contracts and tests, extend them, try out newer and more complex implementations. Whatever you want - except deploying them to prod.

Overview

Contracts increase in complexity. They're meant to be studied sequentially.

• DelegateContractV0
  • Missing receive function => can't receive ETH
  • Lack of access controls in execute => anyone can execute calls
• DelegateContractV1
  • Deceiving constructor. Guardians are not set in the context of accounts delegating to DelegateContractV1.
• DelegateContractV2
  • Open initialization
  • Can be reinitialized
• DelegateContractV3 and DelegateContractV3_1
  • Initialization signature too weak (e.g., replayable across contracts, chains)
• DelegateContractV4
  • Storage collision between paused and init if deployed as an upgrade of V3. Account may start paused and initialized.
• DelegateContractV5
  • Lack of nonce management allows signature replays => oneTimeSend can be used to drain the account.
• DelegateContractV6
  • Anything bad here?

What else?

We might extend this repository with flawed cases of:

• Interactions with the ERC4337 entrypoint
• New signature schemes (such as WebAuthn)
• Standard batch execution interfaces (like EIP-7821)

Resources

• EIP-7702: set EOA account code
• EIP-7821: minimal batch executor interface
• github.com/ithacaxyz/odyssey-examples
• EIP-7702: a technical deep dive by lightclient
• ithaca.xyz/writings/exp-0001
• ithaca.xyz/writings/exp-0002
• github.com/ithacaxyz/account
• EIP-7702 with Scaffold-ETH 2
• Basic EOA Batch Executor by @optimizoor

Disclaimer

All code in this repository is intentionally vulnerable and for educational purposes only. DO NOT USE IN PRODUCTION.