Address Poisoning Warning Tool

WHAT IT DOES

Address Poisoning Warning Tool is a DeFi security tool that watches the page for displayed Ethereum addresses, then compares them against the user's known addresses (connected wallet, saved addresses, and recent transaction recipients) to detect potential address poisoning attempts. It scans the page for address patterns, queries the connected EVM chain for address metadata (balance, transaction count, code), compares addresses against a local database of known addresses, detects similar-looking addresses using Levenshtein distance and character substitution analysis, and displays a visual warning overlay (suspicious/high-risk) next to addresses that show zero or minimal transaction history, have no balance, or were recently created, while flagging addresses that appear similar to known addresses with slight character variations.

WHERE IT RUNS

This tool operates as a panel within the BotGentz browser extension, available for Chrome, Firefox, Edge, and Brave. It works on any webpage displaying Ethereum addresses, such as DEX interfaces, wallet applications, transfer forms, block explorers, and DeFi dashboard sites.

HOW TO USE

Navigate to any page that displays Ethereum addresses. Open the BotGentz extension and select Address Poisoning Warning Tool from the tool menu. The panel will appear on the side of your browser. Click the "Connect Wallet" button to connect your EVM wallet (MetaMask or compatible). Click the "Scan & Analyze" button to detect addresses on the page and analyze them for poisoning risk. The tool will overlay a color-coded badge (green for safe, yellow for low risk, orange for medium, red for high risk) next to each detected address. You can customize sensitivity, minimum balance threshold, and maintain an address book of trusted addresses. Use the "Clear Badges" button to remove all overlays.

TECHNICAL SECTION — ADDRESS POISONING DETECTION PIPELINE

This tool uses a multi-stage detection pipeline to identify potential address poisoning. First, it scans the page DOM for Ethereum address patterns using a regex that matches 0x + 40 hexadecimal characters, and checks data attributes, links, and element content for addresses. Second, it deduplicates found addresses and filters them. Third, it queries the connected EVM chain via window.ethereum using eth_getBalance to check if the address has a balance, eth_getTransactionCount to check transaction history (zero history suggests a newly created address), and eth_getCode to check if it's a contract. Fourth, it compares each address against the user's known addresses (connected wallet, saved addresses, address book) using Levenshtein distance to detect similar-looking addresses. Addresses with a Levenshtein distance of 3 or less from a known address are flagged as suspicious, especially if they also have zero or minimal transaction history. Fifth, it performs character substitution analysis to detect homoglyph attacks (e.g., replacing '0' with 'o', '1' with 'l', '3' with 'e') commonly used in address poisoning. Sixth, it calculates a weighted risk score combining similarity distance, transaction history, balance, and character substitutions, with configurable sensitivity settings. Finally, it overlays a color-coded badge on the page next to each address, providing immediate visual feedback about potential poisoning risks.

THE PANEL

The side panel is designed for seamless integration into your browsing workflow. You can drag it to either side of the window, and it remembers your preferred position per website. It supports snap-to-edge behavior and can be collapsed to a small tab for minimal distraction. The panel is resizable horizontally and vertically, with a minimum width of 280px and maximum of 600px. Pressing the Escape key closes the panel. All settings are saved locally.

PLEASE NOTE

This tool requires the free BotGentz extension and a real EVM wallet extension (such as MetaMask) already installed in your browser. It works with EVM-compatible chains (Ethereum, Polygon, Arbitrum, Optimism, etc.). Cannot detect all address poisoning attempts; relies on transaction history which may be incomplete for newly created wallets. Some legitimate new wallets may appear suspicious. Cannot detect poisoning that uses addresses not displayed on the page. Requires the page to display addresses in a detectable format. Does not guarantee safety. Websites change their page formats frequently, and extraction scripts may need periodic updates. This tool does not store or transmit page content except for the address queries sent to the EVM network. No browsing history or personal data is collected or retained.