Suspicious Signature Request Blocker

WHAT IT DOES

Suspicious Signature Request Blocker watches the current page for signature request patterns, intercepts and analyzes signature requests via window.ethereum, detects suspicious patterns including blind signing, excessive permissions, or requests from known scam patterns, and triggers a warning overlay before the user can sign, with detailed explanations of what the signature would authorize. It protects you from signing malicious messages that could compromise your wallet.

WHERE IT RUNS

This tool operates as a userscript within the BotGentz extension framework, running directly in your browser on any website. It works on any EVM-compatible blockchain page—Ethereum, Polygon, Arbitrum, Optimism, and more—where signature requests are used. The tool integrates seamlessly into your workflow, appearing as a draggable panel that stays accessible as you interact with dApps.

HOW TO USE

The tool automatically intercepts signature requests from the page. When a request is detected, it analyzes the request against known suspicious patterns and displays a warning overlay with the analysis before you can sign. Configure your settings: set the sensitivity level (Low, Medium, or High), add trusted domains to the allowlist to skip checks, toggle auto-block on or off, and toggle logging of signature requests. The panel displays the number of signatures blocked and the current status. Click "Connect Wallet" to activate the interceptor, which will begin monitoring all signature requests.

TECHNICAL OPERATION

Suspicious Signature Request Blocker intercepts window.ethereum.request calls for signature methods (personal_sign, eth_sign, eth_signTypedData, eth_signTypedData_v3, eth_signTypedData_v4). It analyzes the request data to detect suspicious patterns: blind signing (hex messages that are not human-readable), EIP-2612 Permit requests that allow token spending without approval, contract function call signatures, and domain-specific heuristics (airdrop, claim, rewards patterns). The analysis returns a severity level (low, medium, high) and a list of issues. When a suspicious request is detected, the tool displays a full-screen overlay with the analysis and offers the user a choice to block or allow the signature. If auto-block is enabled and the severity is high, the request is automatically blocked. All requests are intercepted in real-time before reaching the wallet UI.

THE PANEL

The Suspicious Signature Request Blocker panel is fully draggable and remembers its position between sessions using GM_setValue. It snaps to the edge of the viewport for a clean interface and can be collapsed to a small icon when not in use. The panel is resizable to accommodate longer content. Press Escape to quickly close or collapse the panel. The design is optimized for productivity with a dark theme, clear visual hierarchy, and responsive controls that adapt to your workflow.

PLEASE NOTE

This tool requires the free BotGentz extension installed in your browser and a real EVM wallet extension (MetaMask, Rabby, etc.) already installed. EVM chains only—this does not work on non-EVM blockchains. The tool cannot detect malicious signatures that use legitimate-looking data, cannot block signatures that are requested directly through the wallet UI, cannot analyze the full intent of a complex contract interaction, and cannot prevent the user from manually signing if they override the warning. No private keys are stored or transmitted. Always verify the message content before signing.