I have a somewhat unusual hobby that is going to websites referred to by [airdropped] scam tokens and see how the scam works exactly. All of those that I've visited so far employed a pretty primitive scam -- they offered to swap these tokens for ETH, USDC, USDT, etc, and then they would ask for unlimited access to your ETH, USDC, etc. If a user is careless and clicks "approve" without reading MetaMask transaction details, then the coins would be gone.
So, in the not so distant past, all those transactions would call method "approve" from the coin's respective smart contract, which was easy to spot. Lately, however, I encountered another way to grant access to tokens -- something that doesn't scream in your face "give me all your tokens".
- One scammy website asked me to sign a non-readable hex data. After I did, they submitted this signed data via executeMetaTransaction function, which gave unlimited USDT access to a 3rd-party address. My assumption was that they created a raw unsigned approve transaction, which I signed, and which was then submitted to the chain.
- Another scammy website asked me to approve a transaction that was branded by MetaMask as "Increase Allowance" (for USDT). There were no other details such as the USDT amount. After I approved this transaction (which required a gas fee), I saw that I granted access to 1,999,999 USDT to a 3rd-party address. After I examined the transaction, I saw that I made a call to increaseAllowance method of the USDT contract.
So, two different methods that have the same end result. While I kind of understand how method #1 works, I am not so sure about method #2. Does this increaseallowance function belong to the USDT smart contract? If so, why does this smart contract even have it? It already has a required EIP-20 method approve, which is much safer to use for users.
Note: this all was done on the Polygon network.
[link] [comments]

You can get bonuses upto $100 FREE BONUS when you:
π° Install these recommended apps:
π² SocialGood - 100% Crypto Back on Everyday Shopping
π² xPortal - The DeFi For The Next Billion
π² CryptoTab Browser - Lightweight, fast, and ready to mine!
π° Register on these recommended exchanges:
π‘ Binanceπ‘ Bitfinexπ‘ Bitmartπ‘ Bittrexπ‘ Bitget
π‘ CoinExπ‘ Crypto.comπ‘ Gate.ioπ‘ Huobiπ‘ Kucoin.
Comments