Wallet or contract
How Forensia decides whether an address is a wallet, a contract, or a wallet that has delegated its behaviour to code.
#Plain languageIn plain terms
Every address on an Ethereum-style network is one of two things. A wallet is controlled by a key. A contract is controlled by code. Which one you are looking at changes what every other record means, so it is the first thing a lookup settles.
There is a third case. Since 2025 a wallet can point at a piece of code and borrow its behaviour. It is still a wallet, held by a key, but it can act like a contract. Forensia reports this as a delegated wallet and shows where it points.
#How it worksHow it works
The lookup asks the network for the code stored at the address at the latest block. No code means a wallet. Code means a contract. One specific 23-byte pattern means a delegated wallet.
- Read the newest block header. Its number becomes the boundary of the whole lookup.
- In one batched request, read the address's balance, its sequence counter (nonce), its code, and three storage slots used by upgradeable contracts.
- Inspect the code and classify the address.
- Record the answer as a finding linked to the exact response it came from.
#Technical detailThe exact rules
The batch is a single JSON-RPC request carrying six calls: eth_getBalance, eth_getTransactionCount, eth_getCode, and three eth_getStorageAt reads, all at latest. It is stored as one evidence record. The first three results are required. The three storage reads are optional and feed proxy resolution. On BNB Smart Chain the batch is not used: the same six reads are sent as separate requests, each stored as its own evidence record.
| Code returned | Classified as | Why |
|---|---|---|
0x or 0x0 | Wallet | Nothing is deployed at the address. |
0xef0100 followed by exactly 20 bytes | Delegated wallet (EIP-7702) | A delegation designator. The 20 bytes are the address it points to. |
| Anything else | Contract | Runtime bytecode is present. |
The delegation check is a strict pattern match on the whole code value: the three marker bytes ef 01 00, then 40 hex characters, and nothing after. A delegation designator is a pointer, not executable bytecode, so the address stays a wallet.
The result is the finding finding:account-classification, class observed. Contract status then switches on the contract-only steps: verification lookup, administrative events, and the selector count.
#LimitsWhat it does not tell you
- Code is read at the latest block. An address that was a contract and has since been destroyed reads as a wallet.
- For a delegated wallet, the code it points to is not fetched or analysed. The page shows the destination and stops.
- A wallet is not a person. Classification says how an address is controlled, not by whom.
- Delegation is not a sign of wrongdoing. Many wallets delegate for ordinary reasons.