How does EIP-7702 change assumptions that smart contracts and dApps make about EOAs, and what would you change in your code?
What the interviewer wants to hear
- EOAs can delegate to contract code, gaining batching, sponsorship and custom logic
- tx.origin == msg.sender and extcodesize checks no longer prove an EOA
- Delegated EOAs can receive callbacks and reenter
- Malicious delegation targets are a phishing risk; storage collisions between delegates
- Design for smart accounts: ERC-1271 signatures, no EOA-only assumptions
Model answer
EIP-7702, live since the Pectra upgrade, lets an EOA sign an authorization that sets its code to point at a contract. Its address and key stay the same, but it can now batch calls, have gas sponsored and run custom validation. That breaks old assumptions. A check like msg.sender == tx.origin no longer means the caller cannot run contract logic, and code size checks fail too. A delegated EOA can also have receive hooks, so transfers to "users" can reenter. In my code I remove any security logic based on EOA detection and rely on proper reentrancy protection and economic limits instead. I support ERC-1271 signature checks alongside ECDSA, since accounts may validate signatures through code. For wallet-facing features, delegation targets are very powerful, so users should only delegate to audited code, and switching delegates needs care with storage layout.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Blockchain Developer questions
- You are designing a new lending protocol. What are the biggest security risks and how do you address them?
- Why have cross-chain bridges been a common target for large hacks, and how would you design a safer cross-chain system?
- What is MEV, and how would you protect your protocol's users from harmful MEV?
- How do you prepare a codebase for a security audit, and what happens after the audit?
- How do you decide what logic and data should live on chain versus off chain in a dApp?
- Your protocol is being exploited right now on mainnet. What do you do in the first hour and afterwards?
- How do you make sure an upgrade to a proxy-based contract does not corrupt storage or break the system?
- You are building an ERC-4626 yield vault. What design and security issues do you consider?
- Your team wants to deploy the same protocol to five EVM chains, including L2s. What can go wrong and how do you prepare?