Dangerous Approval Auto-Flagger

WHAT IT DOES

The Dangerous Approval Auto-Flagger monitors any dApp page where you are about to grant a token approval and automatically scans the spender address against multiple risk databases—including user-defined blocklists, known exploit contract lists, and heuristic pattern detection. When a risky spender is detected, the tool immediately displays a prominent red visual warning near the approval button, explaining why the address is flagged. It also maintains a running list of flagged spenders in the panel for easy review. This provides a crucial real‑time safety check that catches dangerous approvals before you sign, giving you the opportunity to reconsider, cap the approval, or verify the spender further.

WHERE IT RUNS

It runs as a draggable overlay panel inside the BotGentz extension on any website that requests token approvals—Uniswap, SushiSwap, 1inch, Curve, Aave, Compound, OpenSea, Rarible, and thousands of other DeFi and NFT dApps. It works by scanning the page's DOM for approval‑related elements and extracting spender addresses in real time.

HOW TO USE

1. Install the free BotGentz extension and ensure you have an EVM‑compatible wallet extension installed.

2. Navigate to any dApp where you might approve a token.

3. Click the BotGentz icon and select "Dangerous Approval Auto-Flagger" from the tools menu.

4. Click "Start Watching" to begin monitoring the page.

5. When an approval request is detected, the tool checks the spender address against its risk databases.

6. If a risk is detected, a red "RISKY" badge appears next to the approval button with the reason.

7. Review the flagged spender address in the panel's flagged list.

8. Use the "Copy" button to copy the address for further investigation.

9. You can add addresses to your custom blocklist in the settings.

10. Drag the panel to reposition it, resize it, collapse it, or press Escape to close.

THE ACTUAL MECHANISM — multi‑source risk assessment with real‑time DOM injection

This tool employs a comprehensive risk assessment engine that operates in three layers. First, it uses a MutationObserver to watch for DOM changes, scanning for any elements that are likely to trigger approvals—buttons with text like "Approve", "Enable", "Unlock", or "Allow". Second, when such an element is detected, it extracts the spender address by scanning the surrounding DOM for Ethereum addresses using regex matching, prioritizing addresses that appear in known spender contexts (e.g., elements with class/ID containing "spender", "to", or "address"). Third—the core of the risk engine—it evaluates the spender against a stacked risk database: (a) the user's custom blocklist (manually entered addresses), (b) a built‑in list of known risky contracts and exploit addresses, and (c) heuristic pattern detection (e.g., suspicious address patterns, zero addresses, and sensitivity‑based checks). If the address matches any risk criteria, the tool dynamically injects a visual warning badge directly into the DOM next to the approval button, styled with red coloring and a pulse animation to draw attention. The tool is read‑only—it never modifies transaction parameters or submits on‑chain data—ensuring it acts purely as an advisory layer that empowers users to make safer decisions without interfering with their wallet or the dApp.

THE PANEL

The panel is fully draggable by its title bar and snaps to the nearest edge of the viewport when released. You can resize it horizontally by dragging the left or right border; the height expands to fit content up to a maximum, with scrolling inside the flagged list. A collapse button minimizes the panel to a small floating chip showing "⚙️ Approval Flagger" — click it to expand back. Press Escape at any time to close the panel entirely. The panel remembers its last position, size, and expansion state per domain via localStorage.

PLEASE NOTE

- This tool requires the free BotGentz extension and a real EVM wallet extension (e.g., MetaMask) already installed in your browser.

- This tool works only on EVM‑compatible chains.

- The tool cannot detect malicious intent from contract bytecode alone with certainty. It cannot detect newly deployed contracts not yet added to any risk database. It cannot detect approvals that are initiated via non‑standard interfaces (e.g., custom contract calls not using the standard approve function). It cannot prevent a user from approving a flagged spender if they choose to proceed regardless of the warning.

- No private keys, seed phrases, or sensitive data are ever read, stored, or transmitted. Spender address data is checked locally against stored blocklists. Only anonymized usage metrics (panel open/close, flag events) are collected; you can disable this in the extension settings at any time.