GoPlus: Recently, EIP-7702 has triggered multiple contract attacks, and it is recommended that the project party strengthen measures for flash loan attack protection and other measures.

PANews, July 9 news, according to security agency GoPlus, multiple recent contract attack cases have exploited EIP-7702 features to bypass on-chain security checks, including msg.sender == tx.origin and msg.sender == owner, leading to flash loan attacks and price manipulation issues, with losses reaching nearly one million dollars. Case analysis shows that attackers implemented attacks through malicious delegator authorization, affecting well-known DeFi projects including QuickConverter @QuickswapDEX and several CSM liquidity pools. The implementation of EIP-7702 gives EOA addresses smart contract capabilities, rendering traditional security logic ineffective. GoPlus recommends that project teams enhance protection against flash loan attacks and reentrancy attacks, restructure EOA verification and permission management logic, and continuously monitor the delegator authorization status of administrator addresses to prevent potential risks.