Moonkat User Guide

User Guide

Transaction Simulation

The difference between a phishing website and an official website lies in the actions performed and the content claimed.

For example, when you choose to convert 100 USDT into an equivalent amount of ETH on a secure dApp website, it will generate a transaction for your approval based on the action you wish to execute.

The content of this transaction will align with your understanding and expectations.

A phishing website, on the other hand, operates by presenting a different transaction for your approval when you attempt to execute an action. Typically, this transaction would involve transferring all of your valuable virtual assets to their address.

Differentiating the actual execution of transactions on a phishing website is often challenging, particularly when viewing it solely from MetaMask or a similar platform.

Transaction simulation can indeed help determine whether a dApp website is fraudulent or not.

By executing the transaction provided by the website on the blockchain and simulating the impact it would have on your wallet, we can examine the clear changes in assets. This allows us to identify and avoid phishing websites of this nature.

Additionally, there are many phishing websites that impersonate project airdrops to lure you into clicking and claiming the airdrop. In reality, they are transferring your assets into their own pockets. You can also utilize Moonkat to verify whether a website is a phishing site in such cases.

Assets Approval

Set Approval is a functionality used in certain scenarios to grant permission for a dApp to transfer your assets.

Let's consider an example where you visit a legitimate swap website to exchange tokens. Apart from native tokens, most tokens require an approval before the dApp can initiate the transfer of your assets.

Suppose you are using UniSwap for the first time to convert 100 USDT to WETH. In this case, you would need to grant the dApp permission to access and transfer 100 USDT from your wallet. Once you provide the approval, the dApp can take the 100 USDT from your wallet and provide you with an equivalent amount of WETH.

The quantity of Set Approval is indeed important. In the example mentioned earlier, you can simply grant approval for 100 USDT. However, if you intend to exchange USDT for other tokens in the future, you would need to grant approval again.

To avoid the need for repeated approvals, many dApps choose the default option of "Set Approval for All." This means that the dApp can access the total amount of the specified asset in your wallet.

Consequently, you won't have to grant authorization again when exchanging USDT for other tokens. Some users prefer this approach as it reduces the frequency of paying gas fees associated with each approval.

However, when interacting with newer dApps, it is not recommended to set "Set Approval for All" as a default. It is better to manually adjust the specific amount of assets to ensure that the dApp does not have permission to access your entire asset balance.

Signature Decoding

Signing a transaction is similar to a regular transaction, but the key difference is that it doesn't require gas fees.

This can lead to a common misconception among newcomers that transactions without gas fees are safe.

However, in reality, even without gas fees, there are other methods that can be employed to transfer your assets.

Phishing scams of this nature typically exploit the permissions you previously granted to larger projects. They can use these permissions to deceive and steal your assets.

For example, let's say you previously listed an NFT for sale on OpenSea. When listing the item, you would need to grant OpenSea the Approval permission for that specific asset, allowing them to transfer it to the buyer.

In the case of a phishing website, they exploit the permission you granted to OpenSea. They can use the signature format for listing assets on OpenSea and adjust the sale price to zero. So, when you choose to sign the transaction on the phishing website, they instantly transfer your NFT to their address.

By using Moonkat, you can examine the contents of the signature. This allows you to understand the potential outcomes when you sign the transaction.

For example, it could reveal that the signing results in the transfer of an NFT while receiving 1 ETH in return. This helps you avoid falling victim to phishing websites that offer NFTs for zero-cost purchases.