EIP-7702 Victim

Contract Vulnerability

Estimated loss

$17.2K

VERDICT —UNRATED

Verdict pending. Auto-ingested incidents are reviewed before a public verdict is rendered.

▰ METHOD

ACCESS CONTROL

ACCESS-CONTROLBYTECODE CATCHABLE →AI SCANNABLE →

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

A user EOA on BNB Chain (with EIP-7702 delegation) that had set delegated code via an EIP-7702 Type-4 transaction was drained for ~$17.2K. The delegated code included a pancakeV3SwapCallback() function without proper access control. The attacker directly called this callback with crafted calldata, forcing the victim account to transfer its tokens to an attacker-controlled address. The victim had enabled the delegation to support swap-related logic. Attack method (per SlowMist): Contract Vulnerability. Reported loss: $ 17,200.

Primary source

https://blocksec.com/blog/weekly-web3-security-incident-roundup-mar-30-apr-5-2026 ↗

Sourced from

slowmist

Technical record