Signature Request Risk Reader

WHAT IT DOES

Signature Request Risk Reader takes any Ethereum transaction or raw call data and provides a clear risk assessment before you sign. It decodes the function call, extracts all parameters, and assigns a risk level—Low, Medium, High, or Critical—based on what the transaction does. It flags suspicious patterns like unlimited approvals, ownership changes, self-destruct, withdraw functions, and large value transfers. An AI layer then provides a plain-English risk assessment explaining what the transaction does, what permissions it requests, what assets are affected, and whether this is normal or suspicious. All of this happens before your wallet ever asks for a signature—so you know the risk level before you approve.

HOW TO USE

Connect your EVM wallet using the BotGentz wallet bridge. Select the network matching your transaction. Paste a transaction hash to fetch and analyze the full transaction from the chain, or paste raw hex call data (starting with 0x) to decode it directly. Click "Read Risk"—the tool resolves the method ID, extracts all parameters, flags risks, assigns a risk level, and generates an AI assessment. Results show you the risk level (with color-coded tags), sender, recipient, value, function name, decoded parameters, risk flags, and a plain-English risk assessment. No transaction is ever submitted—this tool is read-only and free.

TECHNICAL MECHANISM

The app uses the injected BGWallet bridge to access the EVM provider via ethers.js v5.7.2. Transaction hashes are fetched via provider.getTransaction(). Call data is decoded against a built-in 4-byte signature database covering common ERC20 functions (transfer, approve, transferFrom), ERC721 functions (safeTransferFrom, setApprovalForAll), mint functions, admin functions (owner, renounceOwnership, transferOwnership, pause, unpause), withdraw, and selfdestruct. Each function has an assigned base risk level (low/medium/high/critical). Parameter decoding extracts addresses, uint256 values, and booleans from the hex data. Additional risk flags are added based on detected patterns: unlimited approvals (hex 0xffff...), ownership changes, self-destruct, large value transfers (>1 ETH), withdraw functions, and approval requests. The final risk level is the highest of the base risk and any flags. The decoded function name, parameters, flags, and risk level are passed to the AI bridge (BGAI.generate), which returns a plain-English risk assessment capped at 1,024 tokens.

WHAT IT CANNOT SEE

This tool cannot detect malicious intent hidden in contract bytecode—it reads only the function call data visible on-chain. It cannot verify that the resolved function name from the 4-byte database matches the actual contract implementation—any contract can implement a function with the same method ID but completely different behavior. It cannot verify off-chain intent or consequences of a transaction. It cannot detect cross-contract exploits, reentrancy vulnerabilities, or front-running attempts. It does not simulate transaction execution, so it cannot predict revert conditions or gas exhaustion. The AI risk assessment is generated from the provided data and may miss nuanced attack patterns not present in the call data itself.

PLEASE NOTE

Supports EVM-compatible chains only—Ethereum, Sepolia, Polygon, Mumbai, Optimism, Arbitrum, and any network the wallet bridge connects to. The 4-byte signature database is built-in and covers the most common functions—if a function is not in the database, the tool will show the method ID and raw data but cannot provide a function name or base risk level. Risk assessments are AI-generated and should be treated as assists, not authoritative audits. Always review the transaction details in your wallet's own signature prompt before approving. The wallet's signature step is the only protection that actually gates any action—this tool is informational and does not replace that safeguard. Free to use, no API keys required.