An unreviewed arXiv preprint says attacker-controlled contracts can make wallet previews look favorable while diverting deposits on-chain, with Ethereum accounting for most estimated losses.
Wallet simulation tools can be manipulated to show a small apparent gain even when a signed transaction ultimately sends funds to an attacker, according to a July 30 arXiv preprint. The study used SimGuard, a contract-bytecode detector, to identify 4,224 transaction-simulation phishing contracts across Ethereum, BNB Smart Chain, Avalanche and Polygon, linking the technique to 5,742 victim addresses, 6,223 victim transactions and about $3.48 million in historical losses. The authors said the loss figure should be treated as an upper bound because some attacker test activity may have been misclassified. Ethereum accounted for 91.5% of the estimated losses, and about 83% of the cross-chain total came from the study's largest inferred cluster. The paper has not been peer reviewed and contains inconsistencies in its Avalanche contract count and observation-period endpoints, leaving parts of the cross-chain breakdown unresolved. The authors say some contracts can return one result during simulation and another during execution by changing stored state, relying on later block timestamps or exploiting differences in gas settings. In a controlled test, a contract returned as little as 1 wei while previews still showed a positive estimate and often did not clearly display the full amount leaving the account. The authors recommend rerunning simulations when contract state or gas fields change, matching gas settings to the actual request, and testing current and future block-number and timestamp inputs, while wallet interfaces should show the gross amount leaving an account alongside the net balance change.