Cross-Contract Approval Risk Mapper

WHAT IT DOES

The Cross-Contract Approval Risk Mapper analyzes a pending approve() or setApprovalForAll() transaction to identify cross-contract relationships that could pose a risk. You enter the token address, spender address, and function—the tool reads the spender's contract code via eth_getCode, checks if it has its own approval relationships (via allowance/balanceOf calls), and looks for recent interactions with other contracts via eth_getLogs. It then uses AI to explain whether the spender appears to be a known protocol, a multi-hop contract, or a potentially risky contract that could drain or re-approve your tokens. This helps you understand whether the contract you are approving has connections to other addresses that might move your funds unexpectedly.

HOW TO USE

1. Connect your EVM wallet.

2. Select the chain (Ethereum, Polygon, or Arbitrum).

3. Enter the token contract address, spender address, and function name.

4. Optionally enter the approval amount.

5. Click "Map cross-contract risk" to scan on-chain relationships.

6. Review the AI explanation, risk level, and any identified relationships.

7. The wallet's own signature prompt will still appear—this tool only informs you.

THE REAL MECHANISM — contract code scanning with on‑chain relationship detection

This tool reads the spender contract's code via eth_getCode to determine if it's a contract and to capture a preview of its bytecode. It attempts to read the spender's own allowance relationships via allowance() calls on the spender contract itself (if it supports the ERC-20 interface). It also scans recent Transfer events (last 20,000 blocks) involving the spender address to identify which other contracts it has interacted with. The tool builds a structured prompt for the AI bridge (BGAI.generate) with the spender address, contract code preview, function name, and any discovered relationships. The AI returns a plain‑language risk assessment explaining whether the spender is likely a known protocol, a multi-hop contract, or an unknown high‑risk contract.

WHAT IT CANNOT SEE

- This tool cannot read the exact intent behind the approval—only the on‑chain data.

- It cannot determine with certainty whether a contract is malicious without verified history.

- It cannot detect cross‑contract relationships that are not visible on‑chain (e.g., off‑chain proxy patterns).

- It cannot detect approvals that are submitted through a wallet interface without page interaction.

- It cannot read off‑chain agreements or promises related to the approval.

- It cannot decode custom function signatures that are not in the standard ABI set.

PLEASE NOTE

- This tool works on Ethereum (1), Polygon (137), and Arbitrum (42161).

- The AI explanation is generated from the data you provide and is for guidance only. Always review the actual transaction details in your wallet before signing.

- The wallet's own signature prompt is what actually protects you—the AI's read is not a substitute for reviewing what you sign.

- Event scanning is limited to the last 20,000 blocks; older interactions may not appear.