Blind-Signing Approval Warning Tool

WHAT IT DOES

The Blind-Signing Approval Warning Tool decodes a pending transaction's raw calldata and explains what it actually does in plain language before you sign. You enter the contract address, calldata, and value—the tool identifies whether the transaction calls approve, setApprovalForAll, transfer, mint, swap, or a custom function. It decodes the parameters, reads the recipient/spender address and amount, checks if the contract is verified, and uses AI to generate a plain‑language risk assessment. This helps you avoid blind‑signing attacks where malicious dApps disguise dangerous approvals or transfers as innocuous actions.

HOW TO USE

1. Connect your EVM wallet (optional for analysis).

2. Select your chain: Ethereum, Polygon, or Arbitrum.

3. Enter the contract address being called, the raw calldata (hex starting with 0x), and optional value.

4. Click "Analyze transaction" to decode and assess.

5. Review the decoded function, parameters, risk level, and AI explanation.

6. The wallet's own signature prompt will still appear—this tool only informs you, it does not bypass signing.

THE REAL MECHANISM — calldata decoding with standard ABI matching and AI risk explanation

This tool uses ethers.js to parse the transaction calldata against a set of common function signatures (approve, setApprovalForAll, transfer, transferFrom, mint, swap, deposit, withdraw). It extracts the function name and parameters (spender/recipient, amount, approval status) and checks the contract's code via eth_getCode to determine if it's a contract or an EOA. The tool then builds a structured prompt for the AI bridge (BGAI.generate), passing the decoded function name, spender/recipient address, amount, contract verification status, and a note if the calldata could not be decoded. The AI returns a concise risk assessment and plain‑language explanation of what the transaction does, flagged with a risk level (low/medium/high) based on the function type and contract status.

WHAT IT CANNOT SEE

- This tool cannot read the exact intent behind the transaction—only the on‑chain calldata.

- It cannot determine if the recipient/spender contract is malicious with certainty, only whether it is verified or has known patterns.

- It cannot detect transactions that are submitted through a wallet interface without page interaction.

- It cannot read off‑chain agreements or promises related to the transaction.

- It cannot decode custom function signatures that are not in the standard ABI set.

- It cannot prevent you from signing a transaction—it only provides information.

PLEASE NOTE

- This tool works on Ethereum (1), Polygon (137), and Arbitrum (42161).

- Calldata must be provided as a hex string starting with 0x—the tool will reject invalid input.

- The AI explanation is generated from the data you provide and is for guidance only. Always review the actual transaction details in your wallet before signing.

- The wallet's own signature prompt is what actually protects you—the AI's read is not a substitute for reviewing what you sign.