Malicious Contracts Exploit Wallet Previews

A recent research paper has identified a sophisticated phishing tactic involving malicious smart contracts designed to deceive cryptocurrency wallet transaction simulations. Researchers discovered over 4,200 such contracts across Ethereum, BNB Smart Chain, Avalanche, and Polygon, which successfully tricked approximately 5,700 victims.

These contracts exploit how wallet interfaces preview transaction outcomes before they are confirmed on-chain. By embedding logic that displays a seemingly favorable result during simulation—like returning a small gain—the contracts lure users into approving transactions. However, the actual on-chain execution diverts the user's deposited funds to an attacker-controlled address. The study estimates total historical losses could be as high as $3.48 million, with the majority attributed to Ethereum.

The researchers utilized a tool called SimGuard to detect these deceptive contracts. The technique relies on creating conditional code paths within the smart contract that behave differently during a simulated preview versus during actual execution. Variations include manipulating storage, timestamps, or gas limits to alter the perceived outcome. While the findings suggest a significant threat, the paper notes that the loss estimates are upper bounds and the research has not yet undergone peer review.