How ShieldBot Protects Your Wallet
eth_sendTransaction, eth_signTransaction), batches (wallet_sendCalls) and signature requests (eth_signTypedData and its _v1, _v3 and _v4 forms, personal_sign and eth_sign).
How Risk Is Rated
Every transaction receives a risk score before you sign it. Higher means riskier:
| Risk score | Verdict | What you see |
|---|---|---|
| 0 – 30 | SAFE | The verdict and details; you can continue |
| 31 – 49 | CAUTION | A warning; you choose to proceed or cancel |
| 50 – 70 | HIGH RISK | A strong warning with threat details |
| 71 – 100 | BLOCK RECOMMENDED | The highest risk verdict; blocking is strongly recommended |
| — | UNKNOWN |
The extension shows this as a safety score, 100 minus the risk score, so higher is safer there. These are the default bands. A score in the SAFE band is still shown as CAUTION when the risk engine rates the token medium risk or the data is incomplete, and if a check could not run the result is shown as Unknown instead of a number.
Wallet Drainer Protection
A wallet drainer is a malicious smart contract that exploits ERC-20 approval functions or EIP-712 permit signatures to transfer all tokens from a wallet in a single transaction. Standard browser phishing warnings cannot detect these because they operate at the URL layer — the attack happens at the transaction layer.
ShieldBot helps against wallet drainers by:
- Catching the transaction or signature request before your wallet shows it
- Analyzing EIP-712 permit and Permit2 signature requests for approval exploits
- Flagging contracts whose deployer has a history of risky deployments
- Showing the exact asset change before you sign, when transaction simulation is enabled
Honeypot Detection
A honeypot token allows users to buy but contains hidden code that blocks all sell transactions. The token appears to have liquidity and price action, but holders can never exit.
ShieldBot looks for honeypots in two ways. It simulates a buy and a sell of the token where the chain has a simulator: honeypot.is on Ethereum, BNB Chain and Base, and ShieldBot's own simulation on supported Arbitrum and Robinhood Chain pool routes. On Arbitrum those are pools pairing the token with WETH on Uniswap V3, Uniswap V2 or SushiSwap. On the other chains, and for an Arbitrum token with no such pool (for example one traded only on Camelot, or only against stablecoins), it uses GoPlus's honeypot and tax flags instead. It also checks the contract's bytecode for owner powers a honeypot can use, such as a blacklist or a pause switch, which works even for unverified contracts. If a simulation fails, or neither source answers, the result is Unknown rather than Safe.
Pre-Sign Transaction Simulation
When transaction simulation is enabled, ShieldBot sends the transaction to Tenderly for simulation on a copy of the chain state. Tenderly runs it in a sandbox and returns the tokens and amounts that would leave or enter your wallet.
ShieldBot displays this asset delta before the wallet signature dialog appears. For example: "You will send 2.5 BNB and receive 10,000 TOKEN." Tokens the simulation shows leaving your wallet are listed among the danger signals; they do not change the verdict itself. If the transaction reverts in the simulation, the result is incomplete and cannot be SAFE, and a revert on a contract whose own risk score, before community reports and campaign boosts, is already 30 or more is BLOCK RECOMMENDED.
What we saw on the chain
- 68,666
- new tokens first seen in a liquidity pool
- ~8,000
- new tokens a day
- 28.76%
- of mature tokens met a minimal liquidity or activity bar
- 49%
- could not be resolved either way and are reported as unknown
Observed from 14 to 22 September 2026, about 8.6 days. These figures describe the chain, not ShieldBot scans. A token is counted when it first appears in a liquidity pool, not when it is deployed, and missing evidence is reported as unknown, never as zero. Method and limits