DEV Community

tazvera
tazvera

Posted on

How we warn users about look-alike scam addresses in our crypto wallet

#blockchain #crypto #security #web3

One of the most common crypto scams today does not hack anything. It just copies you.

It is called address poisoning. A scammer creates a wallet address that starts and ends with the same characters as someone you already pay, for example:

Real:  0x1234567890abcdef1234567890abcdef1234abcd
Fake:  0x1234ffffffffffffffffffffffffffffffffabcd
Enter fullscreen mode Exit fullscreen mode

Most wallets show addresses shortened, like 0x1234…abcd. Both look identical. People copy the wrong one from their history and lose money.

I'm building Tazvera, a simple open source wallet in Hindi + English for first-time crypto users in India. For our users, this kind of scam is a real risk, so we built Tazvera Shield: a few simple checks that run on the confirm screen, before any coins leave the wallet.

What Shield checks

  1. Look-alike address: same first 4 and last 4 characters as a contact or a past address, but a different middle → red warning, and the Send button stays locked until the user ticks "I checked every letter".
  2. First-time address: never sent here before → a calm yellow note, no extra taps.
  3. Burn and token contract addresses: sending to 0x000… or to a token's own contract → red warning (coins are usually lost forever).
  4. Smart contract address: we ask the network for the code at that address (eth_getCode). If there is code, we show a gentle note.
  5. Known address: a green "all clear", so normal payments stay fast.

The core check is tiny 

function lookAlike(to, known) {
  to = to.toLowerCase();
  return known.find(k =>
    k.address !== to &&
    k.address.slice(2, 6) === to.slice(2, 6) &&   // same start
    k.address.slice(-4) === to.slice(-4)          // same end
  );
}
Enter fullscreen mode Exit fullscreen mode

known is built only from data already on the user's phone: their address book and the addresses they sent to before. Nothing is uploaded.

Design choices that mattered

  • Warn only when it matters. Our first version showed too many warnings and checkboxes. Users started tapping "OK" without reading. Now a normal send is just: Send → PIN. Red appears only for real danger.
  • Show the full address, highlighted. On the confirm screen we show the whole address with the first 6 and last 4 characters in bold green, so people actually compare it.
  • Block, don't just inform. For red cases, the Send button is disabled until the user confirms they checked.

Try it / help us

Tazvera is a volunteer project by a solo founder, so I can't pay, but ideas, reviews and pull requests are very welcome. What other scam patterns should a wallet warn about? Tell me in the comments 🙏

Top comments (0)