A follow-up to the release of Web3 Antivirus, focusing on how to avoid costly mistakes while hunting for opportunities.

It keeps happening all the time. You are browsing through Web3 tech communities, platforms or services, and you come across a requirement to connect your existing crypto wallet. Why entrust access to your funds immediately, even before you know you want to sign up for the service? What if you are about to empty your account?

Of course, this doesn’t inspire a relaxing user experience within Web3, let alone impede general adoption progress. Also, scams and fakes are getting more and more inventive, which means that we can all be caught off guard, even DeFi giants experience vulnerabilities. This made us think of a way out, so we researched, coded, tested, and finally implemented Web3 Antivirus.

The phishers knocked on our door themselves

It seems like we really had no say in it, our mission just chose us ourselves. While we were busy polishing Web3 Antivirus, we received a sweet email on our Dribbble account. In addition to the praise for the team, there was a job offer involving creating an NFT collection.

In order to assess the current appearance of the page and give a rough estimate, they suggested that we visit a specific website to copy the idea. The PS paragraph read: “If you are having trouble logging in, you will need to connect in the first window and approve the signature request in the second window. In addition, the wallet must have a balance, this is a protection against fraud with multi-accounts”.

Imagine how alert this made us? However, there couldn’t be a better chance to start the game with Web3 Antivirus, and so we did. As our solution investigated suspicious schemes behind the signature of the smart contract in question, the request turned out to be good old phishing in disguise. If we had accepted it, all our chips would be gone.

The fact is that if it weren’t for W3A, we could have signed a kind of “blank check”, since the page camouflaged the scam with a basic procedure of “login with MetaMask”. What exactly was behind the scam? It was just the eth_sign method, targeting all its assets. That is, you confirm it… and say goodbye to your tokens forever.

Sure, we let the Dribbble team know about this social engineering scheme right away—community support caught the issue along the way, and the CEO appreciated our timely warning.

Saying goodbye to scams is now easier

The hack we described above is an eerily common practice, a somewhat similar scheme allowed $1 million of NFTs to be stolen from the Bored Ape Yacht Club. By promoting their phishing links on popular communities, fake airdrop scammers lure users into malicious websites and ultimately sign up for secret messages.

Unlike traditional transactions, these messages are invisible on the blockchain and free of gas fees. Once a user signs them, hackers get easy permission for asset transfer.

Given how popular these one-click scams are, we have meticulously crafted mechanisms to combat them. Web3 Antivirus is well equipped to detect a large number of threats, wallet drain risks, smart contract vulnerabilities, and malicious logic. Also, we are a trust-first team, so we completely rule out requesting access to the user’s seed phrase, wallet, and assets.

In a quick tour mode, what main types of vulnerabilities can W3A point out? That is, it is anything from inadequate access control and Ponzi schemes to mineable value mining, re-entry and much more. Within seconds, Web3 Antivirus emulates all transactions involved in smart contracts, displays their results, and sheds light on potential risks.

Once a suspicious contract is scanned, Web3 Antivirus generates a report with an overall threat score based on a massive underlying risk matrix. And so, you get all the data to make an informed decision. Do the risks seem acceptable? You can proceed with signing a transaction; otherwise, just reject it.