Safety guide

1. How drains happen

Unlimited approvals

An approval lets a contract, the spender, move a token out of your wallet. Many sites ask for an unlimited amount so you never approve again. A malicious or later-compromised spender can then take the whole balance at any time.

ShieldBot: the extension overlay names the spender and what it grants before you sign, marks an unlimited grant as a danger, and flags one to an unverified spender.

Permit and Permit2 signatures

A Permit is an approval given as a signature: no transaction, no gas, and it looks like a harmless sign-in. Once signed, the spender named in it can pull your tokens later. Permit2, a shared contract many apps use, can cover several tokens in one permit.

ShieldBot: the signature overlay labels Permit-style typed data as an approval and shows the fields you are signing, spender included, with the API's verdict.

setApprovalForAll

For NFTs, one call lets a contract move every item in a collection. A fake mint or claim button often asks for exactly this.

ShieldBot: the overlay shows the grant before you sign. /rescue does not list NFT approvals; use your wallet's approval settings or revoke.cash for those.

Fake front-ends and phishing links

A copy of a real site, reached from a search ad, a direct message or a look-alike domain, asks for a drain behind the real interface. Urgency is the tell: claim within 24 hours, verify now. So is a raw hash to sign (eth_sign), which can be a transaction.

ShieldBot: on a known phishing domain the extension shows a warning banner, and a Sign-In with Ethereum message whose domain does not match the site is flagged. eth_sign and an unreadable 32-byte message read Block Recommended; unreadable typed data is at least High Risk. A domain not on the phishing lists gets no banner.

Honeypot tokens

A token you can buy but not sell, or sell at a tax that takes most of the value. The chart looks healthy because nobody can exit.

ShieldBot: /token and the extension run a buy and sell simulation where the chain has one, GoPlus flags elsewhere. When the simulation cannot run, the answer is Unknown, not Safe.

Address poisoning

Someone sends dust from an address whose first and last characters match one you use, so you copy theirs from your history next time.

ShieldBot: the extension remembers addresses you have sent to through it and warns when a new recipient matches one at both ends but differs in the middle. It cannot know addresses you sent to without it.

2. How to protect yourself

Before you sign

• Read the spender and the amount. Approve what you are spending now.
• A message with a spender, an allowed field or a Permit type is an approval. Treat it as one.
• Do not sign a message that is a hash or cannot be read.
• Check the domain in the address bar character by character, and which chain the wallet is on.
• Unknown is not Safe. If a check did not run, wait, or do not sign.

Wallet hygiene

• Hold on a hardware wallet; use a separate hot wallet with small amounts for new sites and mints.
• Revoke allowances you no longer use; they do not expire on their own.
• Bookmark the sites you use and reach them from the bookmark.
• Verify a contract address against the project's own documentation before you interact.
• Turn on Strict mode in the extension to hold Block Recommended and Unknown results instead of offering Sign Anyway.

3. If you think you signed something bad

1. Revoke first, in your wallet's approval settings or at revoke.cash. Even after a loss, a revoke stops the next pull. /rescue <wallet> in Telegram counts ERC-20 allowances on a chain and lists the risky ones; it never revokes for you.
2. Move what is left to a fresh wallet with a new seed phrase. If you typed your seed phrase into a site, do this now; that wallet is gone.
3. Do not sign anything offered as a refund or recovery; follow-up scams target the same people.
4. Report it: /report <address> <reason> in Telegram. Three independent reports mark the address as community-reported in scans. Tell the real project about the fake domain.

4. What ShieldBot does not do

• It warns and lets you decide; outside Strict mode, Sign Anyway stays available.
• It does not revoke, move funds or send transactions.
• The overlay sees requests only while installed; /rescue reads ERC-20 allowances from the chain and says when its history window left the scan incomplete.
• A verified spender can still be malicious; a site not on the phishing lists is not flagged.
• When a check times out or a source is down, the result is Unknown, never Safe.
• On Robinhood Chain, a guard contract allows only a fresh LOW or MEDIUM record; everything else is denied. Permission is not a safety guarantee: the guard accepts MEDIUM risk.

Questions: support@shieldbotsecurity.online.