EIP-7702 vs ERC-4337: What's the Difference and Which One Do You Need?

By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: Oct 30, 2026.

TL;DR: ERC-4337 and EIP-7702 are two routes to "smart" Ethereum accounts. ERC-4337 (live since March 2023) gives you a separate smart contract wallet that runs through bundlers and a shared EntryPoint contract, with no protocol change. EIP-7702 (live since the Pectra upgrade on May 7, 2025) lets your existing address, an ordinary EOA, point to contract code so it can batch calls and use sponsored gas without moving funds. They aren't rivals: since EntryPoint v0.8, a 7702-delegated EOA can be used as an ERC-4337 account. The big difference is the key. A 4337 smart account can rotate a lost or leaked key; a 7702 account is still controlled by its original private key, forever.

I spend a lot of time inside both systems. On the bot side, 7702 changed how fast a compromised wallet gets swept. On the rescue side, it changed what I can do to save the tokens that are still sitting in one. So when people ask me "EIP-7702 vs 4337, which one should I use?", my honest answer is that it's the wrong question for most users, and an important one for anyone holding keys that might be exposed. Here's how I explain it.

What is ERC-4337?

ERC-4337 is a standard for smart contract wallets that works without any change to Ethereum's consensus rules. Instead of sending a normal transaction, your wallet signs a UserOperation, a transaction-like object that describes what the account should do. Those operations go to a separate mempool, where bundlers (services that package many UserOperations into one regular transaction) pick them up and submit them to a single shared contract called the EntryPoint.

The pieces, as described in the ERC-4337 specification and the ERC-4337 docs:

Smart account: a contract wallet with its own validation logic (multisig, passkeys, spending limits, recovery).
Bundler: an off-chain node that collects UserOperations and pays the gas for the bundle transaction up front.
EntryPoint: the singleton contract that validates and executes every UserOperation.
Paymaster: an optional contract that pays gas for the user, either as a sponsor or in exchange for an ERC-20 like USDC.
Factory: deploys the account on its first use, so a user can get an address before the contract exists.

The audited EntryPoint went live on mainnet on March 1, 2023. ethereum.org credits it with more than 26 million smart wallets and 170 million UserOperations. The catch was always migration: to use a 4337 wallet, you had to move your assets to a new address.

What is EIP-7702?

EIP-7702 adds a new transaction type that lets an EOA set code on its own address. An EOA (externally owned account) is the normal key-controlled address that MetaMask or a hardware wallet gives you. Before 7702 it could not run code. After the Pectra upgrade, activated on May 7, 2025, it can.

The mechanics, from the EIP-7702 spec:

The account owner signs an authorization: a tuple of chain ID, the address of a delegate contract, and the account's nonce.
Someone (the owner or a sponsor) includes that authorization in a type 0x04 "set code" transaction.
The protocol writes a delegation indicator (0xef0100 followed by the delegate's address) into the account's code.
From then on, any call to your address runs the delegate contract's code in the context of your account, with your balance and your storage.

The delegation is persistent. It stays until you sign a new authorization pointing elsewhere, or to the zero address, which clears it. An authorization signed with chain ID 0 is valid on every chain that supports 7702, so it's worth reading what you're signing.

What's the difference between EIP-7702 and ERC-4337?

ERC-4337 is a full smart account at a new address; EIP-7702 is your old address borrowing smart account code. Everything else follows from that.

	ERC-4337 smart account	EIP-7702 delegated EOA
Where it lives	Application layer (contracts + bundlers), no fork needed	Protocol level, shipped in the Pectra hard fork
Live on mainnet since	March 1, 2023	May 7, 2025
Address	New contract address; assets must move	Same address you already use
Who controls it	Whatever the account's code says (owners, passkeys, guardians)	The original private key, always, plus the delegate code
Lost or leaked key	Can rotate or replace the signer if the account supports it	Can't. The key keeps full control and can re-delegate
Batching	Yes	Yes
Gas sponsorship / pay gas in tokens	Yes, through paymasters	Yes, through a sponsor or a 4337 paymaster
Extra gas cost	UserOp validation and EntryPoint overhead on every operation	25,000 gas per authorization when you set it (partly refunded if the account already exists), then normal calls
Can send its own ordinary transactions	No, it acts through a bundler or another EOA	Yes, it's still an EOA

The row I care most about is the fifth one. With 7702 you get smart account features, but you don't get away from the private key. If the key leaks, the attacker can do anything you can do, including pointing your account at their own contract.

Can you use EIP-7702 and ERC-4337 together?

Yes, and that's how most wallets now use them. The 7702 authors designed it to be forward-compatible with ERC-4337: the address you delegate to can be existing 4337 wallet code.

The ERC-4337 side caught up with EntryPoint v0.8, released March 26, 2025. It added native support for 7702 authorizations: bundlers accept an eip7702Auth field with a UserOperation, put it in the bundle's authorization list and send the bundle as a type 0x04 transaction. The release also shipped Simple7702Account, a minimal audited account meant to be delegated to by an EOA for batching and sponsored gas.

In practice, that combination gives an existing EOA the best parts of 4337 (paymasters, bundlers, gas paid in USDC) without a new address. That's the setup behind products like the MetaMask smart account, which points your EOA to a MetaMask Delegator contract and says plainly that it "still remains an EOA" controlled by your Secret Recovery Phrase.

Which one should you use?

For most people the wallet decides, and the question is really "should I let my wallet upgrade my account?" Here's how I think about it:

You want one-click approve-and-swap, or to pay gas in a stablecoin, on the address you already have: a reputable wallet's 7702 smart account is fine. MetaMask lets you switch to a smart account or switch back per network, each costing a small gas fee.
You hold serious funds and want key rotation, multisig or social recovery: use a real smart contract wallet (a Safe or a 4337 account) at a new address. 7702 can't give you recovery from a compromised key.
You're building an app: support both. Detect whether the user's address has a delegation indicator, send batched calls when the wallet supports them, and never ask users to sign raw 7702 authorizations from your dapp. The spec itself says wallets, not applications, should handle that.
You're building bots: be aware that 7702 breaks the old assumption that only the owner can move an EOA's balance. Once an address is delegated, any call to it can run code, and its balance can change mid-block. I treat delegated addresses as contracts in simulation.

Is EIP-7702 safe?

The mechanism is sound, but it made one attack much cheaper: sweeping wallets whose keys already leaked. Within weeks of Pectra, Wintermute's research team reported that over 97% of all 7702 delegations pointed at contracts with the same copy-pasted sweeper code, which they nicknamed "CrimeEnjoyor". CoinDesk's write-up puts it at about 79,000 compromised addresses authorized. Wintermute keeps tracking delegations on its Dune dashboard.

The reason is simple. An attacker with your key signs one authorization, and from then on any ETH sent to your address is forwarded automatically by the delegate code, without them having to watch the mempool and outbid you. Security researcher Taylor Monahan's point, quoted by The Block, is the right one: the root problem is the leaked key, not 7702 itself.

The other risk is phishing. A malicious authorization is as dangerous as handing over the key, because the delegate code gets full access to the account. If you suspect your address was delegated to something you don't recognize, I wrote a separate guide on how to check and remove a malicious EIP-7702 delegation.

What do 7702 and 4337 mean for a compromised wallet?

Neither one makes a leaked key safe again, but 7702 changes how rescues work. If your key is exposed, the attacker can always re-delegate the account, so the goal is to move everything still there to a new wallet as fast as possible.

Two rescue patterns now exist side by side:

Flashbots bundles: fund the compromised address with gas and move tokens out in the same bundle, so the sweeper never sees the ETH in the public mempool.
7702 rescues: delegate the compromised EOA to a rescue contract and have a clean wallet pay the gas, so no ETH ever has to land in the hacked address.

I compared them in detail in EIP-7702 rescue vs Flashbots bundles. The short version: 7702 is often cleaner, but it's a race against the attacker's own delegation, and the attacker can re-delegate at any time.

Frequently asked questions

Is EIP-7702 replacing ERC-4337?

No. EIP-7702 lets existing EOAs run smart account code, while ERC-4337 provides the bundlers, paymasters and EntryPoint that many of those accounts use. Since EntryPoint v0.8, a 7702-delegated EOA can act as an ERC-4337 account.

Does EIP-7702 turn my EOA into a smart contract wallet?

Partly. Your address gets delegate code, so it can batch calls and use sponsored gas, but it stays an EOA and the original private key keeps full control.

Can EIP-7702 recover a wallet with a leaked private key?

No. Whoever has the key can sign a new delegation or a normal transaction at any time. Move remaining assets to a new wallet instead.

Do I need ETH for gas with EIP-7702 or ERC-4337?

Not always. With a paymaster or a sponsor, someone else pays the gas, sometimes in exchange for a token like USDC. Without one, you pay in ETH as usual.

How do I undo an EIP-7702 delegation?

Sign a new authorization that delegates to the zero address, which clears the account's code. In MetaMask you can do this by switching the smart account back to a standard account in Account details.

Is ERC-4337 more expensive than a normal transaction?

Usually, yes. Each UserOperation pays for the account's validation and the EntryPoint's overhead on top of the actual call, though batching several actions can make up for it.

7702 and 4337 are good news for everyday users, and a new tool for attackers who already have a key. If your wallet is compromised and a sweeper is taking everything that arrives, that's exactly the case the MEV DAO Token Rescue Bot was built for.