Recognize delegated Ethereum accounts when inspecting code
A service that labels every address with nonempty code as a conventional deployed contract can misclassify an account using EIP-7702 delegation.
Inspect the complete designation
Call eth_getCode for the account at the block you are investigating. A delegation designation is the three-byte marker followed by a 20-byte address. In this example the delegated address ends in 42.
0xef01000000000000000000000000000000000000000042
Check both the prefix and the full 23-byte length. Query the target’s code at the same block to investigate the implementation. When invoked through the authority, the delegated code runs in the authority account’s context.
Preserve the historical relationship
Record the authority, target and block hash. The authority can later authorize another delegation or clear the designation. A current read can therefore point to a different target from the one involved in an earlier incident. eips.ethereum.org EIP-7702