[security] EIP-7702 builder should target ERC-5792 wallet_sendCalls, not bare eth_signAuthorization

[szhygulin]

Finding

When #481 (prepare_eip7702_authorization) is re-opened, design against ERC-5792 wallet_sendCalls as the wallet-side RPC, not against a bare eth_signAuthorization / wallet_signEIP7702Authorization method.

Why

Verified 2026-04-28 via rnd skill:

• WalletConnect 2.x has no standardized 7702 RPC method. WC namespaces spec lists only eth_sendTransaction, eth_signTransaction, personal_sign, eth_signTypedData, eth_sign. No eth_signAuthorization, no wallet_signEIP7702Authorization.
• Wallet vendors are explicitly avoiding exposing bare authorization signing as a dApp-callable RPC (security concern: a malicious dApp could trick a user into delegating EOA control). The industry direction is to wrap 7702 inside wallet_sendCalls (ERC-5792), where the wallet retains full control over which implementation is selected and can show a holistic delegation+batched-call UX rather than a bare signature.
• Ledger's blog explicitly mentions ERC-5792 as the intended dApp integration pattern.

Implication for the eventual builder

• The MCP tool should produce a batched call request payload compatible with wallet_sendCalls, not an unsigned authorization tuple.
• The verify-block (Inv Add Base network support (chainId 8453) #14, #460) should echo back the delegation target and the batched calls — not just the implementation address.
• Pre-sign hash recomputation: the wallet_sendCalls payload is a structured object, not an EVM tx. The existing LEDGER BLIND-SIGN HASH path (RLP keccak over EIP-1559 fields) doesn't apply directly — a separate hash scheme will be needed if/when this is implementable.

Cross-references

• #481 — prepare_eip7702_authorization tracker (re-deferred per this comment)
• #455 — original design (predates ERC-5792 direction)
• #460 — Invariant Add Base network support (chainId 8453) #14 (verify-block applies, but shape changes for batched-call payloads)

Re-evaluation trigger

If a different RPC method becomes the de-facto standard for 7702 dApp integration (e.g. WalletConnect ships a dedicated wallet_signEIP7702Authorization namespace method, or major wallets adopt one), revisit this assumption before coding.

🤖 Generated with Claude Code

[szhygulin]

Consolidated into #481 — see the consolidation comment. The scope amendment (target ERC-5792 wallet_sendCalls rather than bare eth_signAuthorization) is captured there.