Malicious smart contracts have been identified as a threat to the security of crypto wallets, as they can deceive users into thinking their transactions are safe when in reality, their deposits are being sent to attackers. According to a recent arXiv preprint published on July 30, researchers have linked this technique to 5,742 victim addresses and approximately $3.48 million in historical losses.
Using a contract-bytecode detector called SimGuard, the authors uncovered 4,224 transaction-simulation phishing contracts across various blockchains including Ethereum, BNB Smart Chain, Avalanche, and Polygon. These contracts were associated with 6,223 victim transactions, with the majority of losses attributed to Ethereum and its largest inferred cluster.
The study revealed that malicious smart contracts can manipulate wallet previews by displaying a small gain during the simulation, only to redirect the user’s deposit to an attacker-controlled address when the transaction is executed on-chain. This deception can occur through various methods such as storage-control, timestamp-based, and gas-control contracts.
In a controlled test, researchers found that several wallet previews showed a positive estimate even when the final outgoing amount was not clearly displayed. This highlights the importance of verifying transaction details and being cautious when interacting with smart contracts.
While the findings of the study have not been peer-reviewed, the authors recommend re-running simulations when contract states or gas fields change, using accurate gas limit and gas price information, and displaying both the gross amount leaving a wallet and the net balance change to avoid confusion.
It is crucial for users to exercise caution when engaging with smart contracts and to stay informed about potential security risks in the crypto space. By following best practices and staying vigilant, users can protect themselves from falling victim to malicious activities in the ecosystem.