Phishing

This project examines a deceptive blockchain scam called approval phishing, where users unknowingly grant malicious contracts access to their wallet funds. The attack uses a malicious Smart Contract Architecture (SCA) that tricks users into approving a contract controlled by an attacker. Once approval is granted, a malicious External Owned Account (EOA) triggers the contract to transfer tokens without the user’s knowledge. The threat is worsened by weaknesses in wallet user interfaces that fail to clearly warn users about risky approval requests. The scam infrastructure typically operates through a secured web server hidden behind CDN layers, hosting fake investment platforms and a management system for scammers. This project simulates and analyzes such attacks using a Servlet–JSP web application, evaluates wallet vulnerabilities, detects scam behaviors, and suggests safer wallet mechanisms inspired by EIP-4337 account abstraction.