MetaMask / MetaMask/metamask-extension

[Bug]: MetaMask is rejecting EIP-7702 authorization revocations

Open
#35,520 12 comments 14 reactions 0 assignees View on GitHub
Batch-Transactions-(5792-+-7702) external-contributor feature-request INVALID-ISSUE-TEMPLATE regression-prod-13.1.1 Sev2-normal team-confirmations
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

**Describe the bug**

Attempting to send an EIP-7702 revocation (i.e. with the delegate address set to the zero address) results in the following MetaMask error:

```
inpage.js:1 MetaMask - RPC Error: External EIP-7702 transactions are not supported

"{\n \"code\": -32602,\n \"message\": \"External EIP-7702 transactions are not supported\",\n \"stack\": \"Error: External EIP-7702 transactions are not supported\\n at new o (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:5698)\\n at a (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:8789)\\n at Object.invalidParams (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:9295)\\n at chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-4.js:1:88659\\n at Xt.addTransaction (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-3.js:1:278597)\\n at async chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/background-2.js:1:61346\"\n}\n at new o (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:5698)\n at a (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:8789)\n at Object.invalidParams (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:9295)\n at chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-4.js:1:88659\n at Xt.addTransaction (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-3.js:1:278597)\n at async chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/background-2.js:1:61346"
```

I can understand if _new_ wallet authorizations are disallowed for security reasons, but revocations should be allowed to enhance security.

The scenario is: an EOA, for which the user has a backup of the seed phrase or private key, has been delegated to a rogue smart contract. The user wishes to revoke access to the delete and use the EOA "as normal" within MetaMask.

**Expected behavior**

MetaMask should allow EIP-7702 revocations.

**Screenshots/Recordings**

Image

**Steps to reproduce**

Sample JS function to initiate an EIP-7702 revocation:

```js
export async function revoke(address, { provider, account } = {}){
// Attempt a real revoke via EIP-7702 Type 4 tx: set code authorization with zero authority.
if(!provider) return { ok:false, error:'No provider' };
const ZERO = '0x0000000000000000000000000000000000000000';
const tx = {
from: account,
to: address,
type: '0x4',
// Early wallet implementations expect `authorizationList` for EIP-7702
authorizationList: [ { authority: ZERO } ],
value: '0x0',
data: '0x',
};
try{
const hash = await provider.request({ method:'eth_sendTransaction', params:[ tx ] });
console.log('[7702] revoke tx sent', hash);
return { ok:true, txHash: hash };
}catch(e){
console.warn('[7702] type-4 revoke failed', e);
return { ok:false, error: e?.message || 'Type 0x4 transaction not supported by provider' };
}
}
```

Using this function with MetaMask will result in the above error.

**Error messages or log output**

```shell

```

**Detection stage**

In production (default)

**Version**

13.1.1

**Build type**

None

**Browser**

Chrome

**Operating system**

MacOS

Contributor guide

Open the contributing guide

Research direction

Start by tracing the eth_sendTransaction handling for type 0x4 transactions and the authorizationList shown in the reproduction. Reproduce the request against MetaMask 13.1.1 and follow how a zero-address authority is classified. Done means EIP-7702 revocations are accepted while the reported rejection no longer occurs.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
blockchain, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.