A delegation lets your wallet give another contract the ability to act on your behalf. This can be useful for things like bundled transactions or having gas paid for you.

The problem is that if you approve a malicious contract, you may have effectively given an attacker control over your wallet’s incoming funds.

Scammers trick users into signing delegation approvals, often on shady sites disguised as free mints or giveaways. Once approved:

The malicious contract can auto-drain your funds.

Some contracts use a fallback function that instantly forwards out any native tokens your wallet receives.

This means the attacker doesn’t even need to submit a transaction — the drain can happen automatically in the same block that funds arrive.