Reading wallet transaction previews

The wallet popup is your last line of defence. Whatever the website says, the popup shows what will actually happen. A few seconds spent reading it stops most drainers.

The parts of a confirmation screen

1. The requesting site
Shown at the top in most wallets. Check it matches the domain you meant to use. A familiar-looking page on an unfamiliar domain is the most common drainer setup.

2. The request type
- Transaction: something that changes the blockchain and costs gas. - Message signature: plain text, often a login. - Typed data signature: structured data. This can be a login, an order, or a permit that grants an allowance.

3. The contract and function
For transactions, most wallets show the contract address you are interacting with and, if they can decode it, the function name: claim, swap, approve, setApprovalForAll, transfer, multicall and so on.

4. The simulation
Many wallets and security extensions simulate the transaction and show the expected balance changes: what leaves your wallet and what arrives.

5. The value and fee
The amount of the chain's native coin being sent, plus the gas fee.

What a genuine claim usually looks like

• The site matches the project's official domain.
• It is a transaction to the project's claim or distributor contract, often calling a function named claim.
• The simulation shows tokens arriving, and nothing leaving except gas.
• There is no approval and no permit.

Signs that something is wrong

• Assets leaving in the simulation when you expected only to receive.
• An approval or permit on a claim, mint or "verify" page.
• A large native coin value attached to a "free" claim.
• The wallet cannot decode the request and shows only hex data on an unfamiliar site.
• The site asks you to ignore the warning, or says "the wallet shows an error but it's fine".
• Unusually high gas for a simple action, which can mean many operations are bundled.

Simulations help, but they are not perfect

Simulations predict the result based on the current blockchain state. Some drainers try to detect simulators and behave differently, or use signatures that only take effect later. Treat a clean simulation as necessary, not sufficient: still check the domain and the request type.

Hardware wallet screens

If you use a hardware wallet, read the details on the device, not just on your computer. If the device can only show a hash ("blind signing"), stop and ask why a simple claim needs that.