Approval Simulator Before Sign

WHAT IT DOES

Approval Simulator Before Sign is a critical security tool that lets you preview exactly what permissions a wallet approval request will grant before you sign it. When you visit any webpage that contains contract addresses or approval-related content, the tool automatically detects potential approval patterns (ERC-20 approve, ERC-721 setApprovalForAll, ERC-1155 setApprovalForAll) and allows you to simulate the approval using a static eth_call. The simulation reveals: the contract address requesting approval, the token being approved, the approved amount (or "unlimited" if the contract requests max uint256), your current allowance before the approval, and the new allowance after. The panel displays a comprehensive risk assessment with warnings for dangerous patterns including unlimited approvals, unverified contracts on Etherscan, first-time interactions with a contract, and suspicious address patterns. To prevent accidental approvals, the tool requires you to manually type the contract address or token name as confirmation before the approval can proceed. The tool does not modify or block the actual approval—it provides transparency so you can make an informed decision.

WHERE IT RUNS

This overlay operates on any website (matching all URLs) across the entire web. It works in any browser that supports the BotGentz extension framework and has an EVM-compatible wallet extension installed. The panel automatically activates on every page, scanning for contract addresses and approval patterns, and provides a simulation interface for any detected or manually entered contract address.

HOW TO USE

Install the extension and navigate to any webpage that may request wallet approvals. The panel will automatically detect contract addresses and approval patterns on the page. Select a contract from the dropdown or paste a custom address, then click "Simulate Approval." The tool queries the current approval state via eth_call and displays the simulation results including the current allowance, risk level, and warnings. Review the simulation carefully—if the approval is unlimited or the contract is unverified, the tool highlights these risks in red. To proceed with the actual approval, you must check all confirmation boxes acknowledging you have verified the contract address and understand the risks, then type the contract address exactly to confirm. The tool also allows you to add trusted contracts to reduce future warnings. Configure settings including simulation gas limit, auto-simulate on detection, and trusted contract management.

MECHANISM: STATIC CALL SIMULATION WITH REAL-TIME APPROVAL STATE QUERY

Unlike basic approval warnings that only show surface-level information, this extension performs an actual on-chain simulation using eth_call to query the current approval state before you sign. The tool uses ethers.js loaded at runtime to construct a static call to the token contract's allowance() function (for ERC-20) or isApprovedForAll() function (for ERC-721/ERC-1155), passing the user's wallet address and the spender/operator contract address as parameters. The call returns the current approval amount or boolean state, which the tool then displays alongside the proposed approval. For ERC-20 approvals, the tool also calculates whether the requested amount equals the maximum uint256 value (2^256-1), which would grant unlimited spending权限. For ERC-721/ERC-1155, it checks if the operator is already approved for all tokens. The risk assessment engine combines multiple signals: (1) contract verification status via Etherscan API (simulated in this version with heuristic patterns), (2) unlimited approval detection, (3) trusted contract list matching, (4) domain reputation analysis, and (5) first-time interaction detection. The mandatory typing confirmation creates a cognitive verification step that prevents impulsive approvals—a security best practice proven to reduce phishing success rates. The tool stores trusted contract lists and simulation history locally using GM_setValue, allowing the risk assessment to improve over time.

THE PANEL

The overlay panel is fully draggable via its title bar and remembers its position per-site using GM_setValue. It snaps to the nearest edge when dragged within 40px of any screen boundary. The panel includes clear sections for page analysis (domain, wallet address, detected contracts, detected approval patterns), contract selection (dropdown of detected contracts plus custom address input), simulation (results display including current allowance, risk level, warnings, and detailed breakdown), confirmation (checkboxes and typing input to verify contract address), and settings (gas limit, auto-simulate toggle, trusted contracts management with add/remove functionality). The simulation results display color-coded risk levels—green for low, yellow for medium, red for high—making it easy to assess danger at a glance. Pressing Escape temporarily dismisses the panel until you navigate to a new page or manually reactivate. The panel automatically re-scans the page when new content loads or when contract addresses appear.

PLEASE NOTE

This extension requires the free BotGentz framework extension to be installed and active. You must also have a real EVM-compatible wallet extension (such as MetaMask, WalletConnect, Coinbase Wallet, or Rabby) already installed in your browser—the overlay uses your wallet's RPC provider to make eth_call queries and to read approval states. This tool is read-only—it does not modify, block, or intercept wallet approval popups (wallet UI is browser-native and not accessible). It only provides simulation results and requires manual confirmation before approvals proceed. The tool cannot simulate approvals for contracts that do not implement standard ERC-20/ERC-721/ERC-1155 interfaces; cannot predict the outcome of approvals that involve complex logic beyond simple allowance checks; depends on third-party APIs (Etherscan) that may be rate-limited or unavailable; cannot detect approvals that are initiated via contract interactions rather than direct approve() calls; cannot prevent approvals if the user confirms in wallet; does not support non-EVM chains where standard interfaces differ; and cannot simulate approvals for functions with custom signatures not in the standard ABI. No private keys, wallet balances, browsing history, or contract data are ever collected, transmitted, or stored outside your local browser—all simulations and risk assessments are performed locally using GM_setValue. This tool is a security aid, not a guarantee—always verify contract addresses independently and never approve transactions to contracts you do not fully understand.