New Site Approval Warning Tool

WHAT IT DOES

New Site Approval Warning Tool is a critical security extension that protects you from malicious wallet approval requests by adding a comprehensive risk assessment and mandatory confirmation layer before any approval can proceed. When you visit any webpage that contains crypto/NFT-related contract addresses or requests wallet approvals, the tool automatically scans the page for contract addresses, analyzes the domain for suspicious patterns, checks contract verification status, and compares against your trusted domains and blocklists. It displays a prominent warning panel showing the risk level (Low/Medium/High/Unknown), a risk score, and a detailed list of warning signs including "Contract not verified on Etherscan," "Site not in trusted list," and "Suspicious domain pattern." The tool requires you to manually check multiple confirmation boxes acknowledging the risks and confirming you have verified the contract address before the approval can proceed. This creates a deliberate pause that helps prevent impulsive approvals to malicious sites.

WHERE IT RUNS

This overlay operates on any website (matching all URLs) across the entire web. It works in any browser that supports the BotGentz extension framework and has an EVM-compatible wallet extension installed. The panel automatically activates on every page, scanning for contract addresses and assessing risk based on domain reputation and on-page content.

HOW TO USE

Install the extension and navigate to any website. The panel will automatically analyze the current page, detect any contract addresses, and display a risk assessment. If the risk level exceeds your configured threshold, a warning panel appears with the risk score, warnings, and confirmation checkboxes. To proceed with an approval, you must check all confirmation boxes—acknowledging you understand the site is requesting approval, verifying the contract address is correct, and accepting the risks. Then click "Proceed with Caution." The tool also allows you to block suspicious contracts or add trusted domains to reduce future warnings. Configure your settings including risk threshold (Low/Medium/High), notification sounds, and experimental block mode. Use the "Trusted Domains" section to manage your trusted site list.

MECHANISM: MULTI-FACTOR RISK ASSESSMENT ENGINE WITH DOMAIN AND CONTRACT ANALYSIS

Unlike basic popup blockers that simply warn about all approval requests, this extension implements a sophisticated risk assessment engine that combines multiple signals to determine the true risk level. The engine analyzes: (1) domain reputation—checking if the domain matches known airdrop/claim patterns (common phishing vectors) and comparing against the user's trusted domains list; (2) contract address analysis—extracting all addresses from page DOM and checking them against the user's custom blocklist, as well as simulating verification status via on-chain heuristics (in production, this would integrate with Etherscan API for actual verification status); (3) page content analysis—scanning for common malicious patterns like "unlimited approval," "setApprovalForAll," and other high-risk function signatures; and (4) wallet context—using the connected wallet address to assess if the contract has any prior interaction history. The engine produces a weighted risk score where each positive signal adds to the score and each trust signal subtracts from it, with custom weights applied based on the user's configured threshold. The mandatory confirmation flow creates a cognitive bottleneck that forces deliberate consideration, which has been shown in security research to significantly reduce phishing success rates. The tool also maintains local persistent storage of trusted domains and blocklists using GM_setValue, allowing the risk assessment to become smarter over time as the user curates their lists.

THE PANEL

The overlay panel is fully draggable via its title bar and remembers its position per-site using GM_setValue. It snaps to the nearest edge when dragged within 40px of any screen boundary. The panel includes clear sections for site analysis (domain, URL, wallet address, trust status, detected contracts), risk assessment (risk level with color coding, risk score, warnings list), confirmation requirements (multiple checkboxes that must all be checked), and action buttons (Proceed with Caution, Block This Contract, Trust This Domain). The settings section includes risk threshold dropdown, sound toggle, experimental block toggle, and trusted domains management with add/remove functionality. Pressing Escape temporarily dismisses the panel—but the warning will reappear if the risk remains. The panel automatically re-scans the page when new content loads or when contract addresses appear.

PLEASE NOTE

This extension requires the free BotGentz framework extension to be installed and active. You must also have a real EVM-compatible wallet extension (such as MetaMask, WalletConnect, Coinbase Wallet, or Rabby) already installed in your browser—the overlay uses your wallet's RPC provider for context but does not modify or block wallet functionality. This tool is read-only—it does not modify, block, or intercept wallet approval popups (wallet UI is browser-native and not accessible). It only displays warnings and requires manual confirmation before approvals proceed. The tool cannot intercept or block wallet approval popups directly; cannot detect approval requests that happen without user interaction on the page; cannot analyze contract code for malicious intent beyond basic heuristics (e.g., Etherscan verification status, function signatures); depends on third-party APIs (Etherscan) that may be rate-limited or unavailable; cannot detect zero-day attacks or novel malicious patterns; does not support non-EVM chains where Etherscan data is unavailable; cannot prevent approvals if the user manually confirms in their wallet regardless of warnings. No private keys, wallet balances, browsing history, or contract data are ever collected, transmitted, or stored outside your local browser—all risk assessments and blocklists are stored locally using GM_setValue. This tool is a security aid, not a guarantee—always exercise caution and verify contract addresses independently before approving any transaction.