The most delegated contract in my EIP-7702 sample ends in these 12 bytes: a164736f6c6343000822000a. Most Solidity contracts built with default settings end in 53. The longer tail is a small CBOR map the compiler appends to the bytecode: an IPFS hash of the contract\u2019s metadata file, the compiler version, and two bytes giving the map\u2019s length. This one has the version and no\u00a0hash.<\/p>\n
On 8 September I pulled every EIP-7702 authorization from a 200-block window on Ethereum mainnet, 1,178 of them, and read the bytecode of the 59 contracts they delegated to. Nine of those authorizations pointed at the zero address, which is how an account undelegates, so 1,169 went to real code. When I went back over the 59 on 11 October, ten had the short tail. I left a note beside them: no metadata hash, so maybe nobody meant the source to be\u00a0found.<\/p>\n
Read as CBOR, a1 opens a map with one entry, 64 says a four-byte string follows (solc), and 43 says a three-byte value follows: 00 08 22, which is version 0.8.34. The last two bytes, 00 0a, give the length of everything before them, ten. So the compiler version survives. What\u2019s gone is the hash that would let anyone fetch the exact metadata file, the one that lists every source file\u2019s own hash and the compiler settings. In solc that\u2019s a single setting, metadata.bytecodeHash set to none, and Foundry exposes it as bytecode_hash.<\/p>\n
The last bytes of two EIP-7702 delegates. Both record the compiler version; only one carries the metadata\u00a0hash.<\/p>\n
Today I asked Blockscout\u2019s API whether each of the 59 has verified source, and asked Sourcify the same. Nine of the ten stripped contracts are verified on Blockscout. Of the 46 that kept the full hash, 21 are. The other three have no CBOR tail at all, and one of those is verified.<\/p>\n
Counting authorizations instead of contracts widens the gap. In that September window, 369 of the 371 authorizations to stripped delegates went to a contract with published source. For the full-hash contracts it was 324 of 774, about\u00a042%.<\/p>\n
59 delegate contracts from one 200-block window in September, verification read on 27\u00a0October.<\/p>\n
The one stripped contract with no source, 0xbaa66503…, drew two authorizations. The second most delegated contract in the whole sample, 0x67b743f3… with 144, carries a full IPFS hash and has no verified source on either service. Neither does 0x912518c2… with 96. Three unverified contracts of 2,140 bytes each carry the same IPFS hash, so they\u2019re one build deployed three\u00a0times.<\/p>\n
The nine verified ones carry six contract names: Uniswap\u2019s CaliburEntry at three addresses, Alchemy\u2019s SemiModularAccount7702 at two, two TokenPocket delegators, UniversalGaslessDelegate, and the most delegated contract of all, with 308 of the window\u2019s authorizations, whose verified source names it Poisoner.<\/p>\n
The ten stripped delegates. Blockscout and Sourcify read 27 October; authorizations from the 8 September window.<\/p>\n
Calibur\u2019s foundry.toml and the one in Alchemy\u2019s modular-account repository both set bytecode_hash = “none” as the project default. Neither file says why. Five of the ten addresses look mined: two start with eight zeros, one with 0x0000fb7702, one with 0x69007702, and one starts 0x77021100 and ends 0000. The metadata hash changes whenever a comment or a file path changes, even when the compiled code doesn\u2019t, and an address found by searching CREATE2 salts depends on the exact bytecode. Dropping the hash ties the bytecode to the code alone. That\u2019s my reading of the reason, not something either project\u00a0says.<\/p>\n
Sourcify answered for eight of the stripped contracts, and all eight came back as match, none as exact_match. Of the full-hash contracts it has, 13 of 17 are exact. Sourcify\u2019s docs say an exact match rests on the metadata hash in the deployed code agreeing with the recompiled one, which is how it proves the source files are byte for byte the ones the author compiled. With no hash in the bytecode there\u2019s nothing for that check to hold on to, so I\u2019d expect every stripped contract to stop at match, whoever wrote\u00a0it.<\/p>\n
The authorization counts come from one 200-block window in September, so they say which delegates were busy then. Verified means Blockscout\u2019s flag and Sourcify\u2019s record as I read them on 27 October. I didn\u2019t check Etherscan, which wants an API key, and a contract could be verified there and nowhere else. I also tried two public IPFS gateways for the hashes on the unverified contracts and both refused the requests, so I can\u2019t say whether any of those metadata files exist somewhere.<\/p>\n
Ten EIP-7702 delegates strip their metadata hash. Nine of them publish their source<\/a> was originally published in Coinmonks<\/a> on Medium, where people are continuing the conversation by highlighting and responding to this story.<\/p>","protected":false},"excerpt":{"rendered":" I\u2019d marked them as the likely hidden code. Of the 46 delegates that keep the hash, fewer than half are verified. The most delegated contract in my EIP-7702 sample ends in these 12 bytes: a164736f6c6343000822000a. Most Solidity contracts built with default settings end in 53. The longer tail is a small CBOR map the compiler […]<\/p>\n","protected":false},"author":0,"featured_media":244743,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-244742","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-interesting"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/244742"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=244742"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/244742\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/244743"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=244742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=244742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=244742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}