TRANSACTION SECURITY
Transaction simulation phishing: why a wallet preview can be wrong
Learn how a transaction can look harmless or profitable in a wallet preview yet execute differently on-chain, and what to verify before signing.
Treat a preview as evidence, not a guarantee
Transaction simulation estimates what a transaction would do against a particular blockchain state and execution context. A 2026 research preprint describes phishing contracts designed to show a benign or profitable outcome during simulation while taking a different branch when the transaction executes on-chain.
Wang et al.: Blockchain Transaction Simulation Phishing ↗Understand how the result can change
The researchers identified contracts whose behavior depends on mutable storage, an external contract, gas settings, gas price, block number, or timestamp. In one documented pattern, a simulation returns the deposit plus a tiny apparent profit. Before execution, the attacker changes contract state so the submitted transaction sends the deposit to an attacker-controlled address.
Research taxonomy and motivating example ↗Prefer protection that enforces the preview
Some wallets can enforce the simulated conditions on-chain instead of showing only an off-chain estimate. MetaMask documents an Added protection mode that reverts the transaction when execution does not match the preview. Where your wallet and network support an equivalent protection, enable it for unfamiliar dApps, complex transactions, or significant value. Check the wallet’s current coverage and limitations; this does not authenticate the website or make every transaction safe.
MetaMask: enforced transaction simulations ↗Question the transaction’s purpose
A reassuring balance-change preview does not explain why an unfamiliar site needs you to send assets to a contract. Be especially cautious when a claim, airdrop, reward, or test transaction asks you to deposit value first. Stop if the transaction’s value, recipient, approvals, or requested action does not match the task you intended.
Verify outside the page that created the request
Open the service from a saved bookmark or an independently verified official source. Compare the contract and network with official documentation. Read the wallet’s raw transaction details as well as its summary. If the opportunity depends on urgency or guaranteed profit, do not sign while the discrepancy remains unresolved.
Know what CryptoStronghold can and cannot check
CryptoStronghold’s URL tool can explain selected address patterns without opening the submitted site. It does not simulate transactions, analyze contract bytecode, monitor blockchain state, or predict the final execution path. A clean-looking URL and a reassuring wallet preview are both incomplete evidence.