DEV Community

Cover image for Read what you sign: 5 function selectors that should make you stop (with a small decoder)
cryptostrapon
cryptostrapon

Posted on

Read what you sign: 5 function selectors that should make you stop (with a small decoder)

#web3 #security #javascript #ethereum

When a dapp asks you to confirm a transaction, the wallet shows a summary. The raw data field is where the truth is, and its first four bytes (the function selector) say what is being called.

Here are selectors worth recognising on the Ethereum virtual machine:

Selector Function Why it matters
0x095ea7b3 approve(address,uint256) Lets a spender move your token. "Unlimited" amounts are the risky part
0xa22cb465 setApprovalForAll(address,bool) Lets an operator move all your NFTs of a collection
0x39509351 increaseAllowance(address,uint256) Same idea as approve, added on top of an existing allowance
0x23b872dd transferFrom(address,address,uint256) Moves tokens using an allowance. Normal for swaps, a red flag if you did not start a swap
0xa9059cbb transfer(address,uint256) A plain send. Check the recipient

A small decoder (17 lines) 

const WATCH = {
  "0x095ea7b3": "approve: gives a spender permission to move your tokens",
  "0xa22cb465": "setApprovalForAll: gives an operator access to ALL your NFTs in a collection",
  "0x39509351": "increaseAllowance: raises a spender's permission",
};

function explain(data) {
  const selector = data.slice(0, 10).toLowerCase();
  if (!WATCH[selector]) return null;
  const MAX = (1n << 256n) - 1n;
  let note = WATCH[selector];
  if (selector === "0x095ea7b3") {
    const amount = BigInt("0x" + data.slice(74, 138));
    if (amount === MAX) note += " (UNLIMITED amount)";
  }
  return note;
}
Enter fullscreen mode Exit fullscreen mode

It reads the first four bytes and, for approve, checks if the amount is the maximum possible value (all bits set). Use it in a wallet UI, a browser tool or an internal review step.

What to do as a user

  • An approval is not a payment. Ask: why does this site need permission to move my tokens?
  • Prefer exact amounts over "unlimited" when the interface lets you choose.
  • Revoke approvals you no longer use. Open source tools and block explorers can list them.
  • If you did not start a swap, mint or claim, any transferFrom or approval request is suspicious.
  • A hardware wallet shows less detail on small screens, so read carefully and never approve something you cannot explain.

Follow for more plain-language scam breakdowns and open tools from CryptoStrapon. Everything we publish is free and open (MIT code, CC BY 4.0 content).

Not sure about a message, link or token? Free checker, no sign-up: https://cryptostrapon.com/scam-detector?utm_source=devto&utm_medium=article&utm_campaign=selectors

Test yourself with the open quiz (50 scenarios): https://cryptostrapon.github.io/crypto-scam-quiz/

If the quiz or this decoder is useful, a star on GitHub helps other people find it: https://github.com/cryptostrapon/crypto-scam-quiz

Top comments (0)