MetaMask / MetaMask/metamask-extension
[Bug]: MetaMask is rejecting EIP-7702 authorization revocations
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
**Describe the bug**
Attempting to send an EIP-7702 revocation (i.e. with the delegate address set to the zero address) results in the following MetaMask error:
```
inpage.js:1 MetaMask - RPC Error: External EIP-7702 transactions are not supported
"{\n \"code\": -32602,\n \"message\": \"External EIP-7702 transactions are not supported\",\n \"stack\": \"Error: External EIP-7702 transactions are not supported\\n at new o (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:5698)\\n at a (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:8789)\\n at Object.invalidParams (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:9295)\\n at chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-4.js:1:88659\\n at Xt.addTransaction (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-3.js:1:278597)\\n at async chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/background-2.js:1:61346\"\n}\n at new o (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:5698)\n at a (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:8789)\n at Object.invalidParams (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-2.js:3:9295)\n at chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-4.js:1:88659\n at Xt.addTransaction (chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/common-3.js:1:278597)\n at async chrome-extension://nkbihfbeogaeaoehlefnkodbefgpgknn/background-2.js:1:61346"
```
I can understand if _new_ wallet authorizations are disallowed for security reasons, but revocations should be allowed to enhance security.
The scenario is: an EOA, for which the user has a backup of the seed phrase or private key, has been delegated to a rogue smart contract. The user wishes to revoke access to the delete and use the EOA "as normal" within MetaMask.
**Expected behavior**
MetaMask should allow EIP-7702 revocations.
**Screenshots/Recordings**
**Steps to reproduce**
Sample JS function to initiate an EIP-7702 revocation:
```js
export async function revoke(address, { provider, account } = {}){
// Attempt a real revoke via EIP-7702 Type 4 tx: set code authorization with zero authority.
if(!provider) return { ok:false, error:'No provider' };
const ZERO = '0x0000000000000000000000000000000000000000';
const tx = {
from: account,
to: address,
type: '0x4',
// Early wallet implementations expect `authorizationList` for EIP-7702
authorizationList: [ { authority: ZERO } ],
value: '0x0',
data: '0x',
};
try{
const hash = await provider.request({ method:'eth_sendTransaction', params:[ tx ] });
console.log('[7702] revoke tx sent', hash);
return { ok:true, txHash: hash };
}catch(e){
console.warn('[7702] type-4 revoke failed', e);
return { ok:false, error: e?.message || 'Type 0x4 transaction not supported by provider' };
}
}
```
Using this function with MetaMask will result in the above error.
**Error messages or log output**
```shell
```
**Detection stage**
In production (default)
**Version**
13.1.1
**Build type**
None
**Browser**
Chrome
**Operating system**
MacOS
Contributor guide
Research direction
Start by tracing the eth_sendTransaction handling for type 0x4 transactions and the authorizationList shown in the reproduction. Reproduce the request against MetaMask 13.1.1 and follow how a zero-address authority is classified. Done means EIP-7702 revocations are accepted while the reported rejection no longer occurs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- blockchain, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100