{"id":"detector.delegate_change.v1","title":"EIP-7702 delegate changed on an agent wallet","unit":"detections (one per wallet per read that found a change)","chain_set":"eip155:8453 (Base)","window":"between two consecutive code reads of the wallet (delegated wallets re-read every 12 hours, undelegated ones every 48 hours, afg-delegates)","definition":"An info detection (delegate_changed) when a wallet bound to a registered agent answers eth_getCode with a different EIP-7702 designator than at the previous read: it now delegates to another implementation, delegates where it did not, or no longer delegates. The first read of a wallet is not a change. The row carries both implementation addresses (null where none) and the read time.","method":"afg-delegates reads eth_getCode for every bound wallet due for a re-read; a 23-byte answer 0xef0100 || address is a delegation (EIP-7702); the previous value is the wallet's stored implementation. Written to the incidents table as kind delegate_changed, severity info, never open: it is a dated note for a human, not a live incident under incident.live.v3.","excludes":["Wallets not bound to a registered agent.","Changes that happen and revert between two reads (not observable at this cadence).","Smart-contract wallets (they never carry a 7702 designator)."],"does_not_assert":["That the new delegate is malicious or the old one was safe: unknown is not malicious, and a sweeper is identified only by the published fingerprints.","Who changed the delegation: the key holder, a platform, or a thief leave the same row."],"source":"AFG-Pulse delegates","since":"2026-10-24","revisions":[],"body_sha256":"dd52fb9db7853f44226417f3a2e166229ab4e4ad11b74a7951fafa974c68dfee","url":"https://agenticfinancegraph.com/def/detector.delegate_change.v1","ladder":"https://agenticfinancegraph.com/ai-agent-liveness-methodology-l0-l9-ladder","license":"https://creativecommons.org/licenses/by/4.0/","attribution":"Agentic Finance Graph — https://agenticfinancegraph.com"}