Malicious Spender Address Flagger
Free to download on every platform. Comes pre-installed on BotFone, BotPad and BotFlip — with extra free apps included.
About this app
WHAT IT DOES
The Malicious Spender Address Flagger analyzes a spender address before you sign an approve() or setApprovalForAll() transaction. You enter the spender address and optional token address—the tool reads the spender's contract code via eth_getCode, checks if it's a contract or EOA, estimates contract age (via transaction count), and checks for recent activity. It then uses AI to generate a risk assessment (Low/Medium/High) and flags suspicious patterns: unverified contracts, very recent creations, EOAs with no transaction history, and other heuristic indicators. This helps you avoid approving a malicious spender that could drain your tokens.
HOW TO USE
1. Connect your EVM wallet (required for some checks).
2. Select the chain (Ethereum, Polygon, or Arbitrum).
3. Enter the spender address you want to check.
4. Optionally enter the token address for context.
5. Select the function name (approve or setApprovalForAll).
6. Click "Flag spender" to run the analysis.
7. Review the risk level, AI explanation, and raw data.
8. The wallet's own signature prompt will still appear—this tool only informs you.
THE REAL MECHANISM — contract code and age analysis with AI risk scoring
This tool reads the spender's code via eth_getCode to determine if it's a contract or EOA. If it's a contract, it estimates the contract's age by checking the transaction count—a contract with zero transactions is flagged as "very recent" and high-risk. It also attempts to approximate the creation time by looking at the block number of the first transaction (within a heuristic range) and flags contracts created less than 24 hours ago. For EOAs, it checks the transaction count and flags addresses with no history. The tool builds a structured prompt for the AI bridge (BGAI.generate) with all collected data, and the AI returns a risk assessment and explanation. The tool also applies heuristic overrides: unverified contracts, very recent contracts, and new EOAs are automatically flagged as high-risk.
WHAT IT CANNOT SEE
- This tool cannot read the exact intent behind the approval—only the on‑chain parameters.
- It cannot determine with certainty whether a spender is malicious without verified history.
- It cannot detect malicious spenders that are newly deployed and not yet flagged.
- It cannot detect approvals that are submitted through a wallet interface without page interaction.
- It cannot read off‑chain agreements or promises related to the approval.
- It cannot guarantee that a flagged address is malicious—only raises a warning based on heuristics.
PLEASE NOTE
- This tool works on Ethereum (1), Polygon (137), and Arbitrum (42161).
- The AI explanation is generated from the data you provide and is for guidance only. Always review the actual transaction details in your wallet before signing.
- The wallet's own signature prompt is what actually protects you—the AI's read is not a substitute for reviewing what you sign.
- Contract age estimation is heuristic and may not be perfectly accurate—use it as a signal, not a definitive proof of malicious intent.
Similar Apps
