How watching friends get scammed led me to rethink crypto security from the ground up.
The Problem
If you spend enough time in Web3, you eventually see a friend get their wallet drained. It's devastating. One minute they're excited about a new DeFi opportunity, the next they're staring at a $0 balance and a transaction they don't remember authorizing.
I've been there. Multiple times. Watching friends lose money to scams I could see coming—but couldn't explain to them in time.
The most frustrating part wasn't the loss itself. It was the UI.
The Flaw: Hex Codes Cause Alert Fatigue
When a user encounters a malicious smart contract, most existing security tools show them something like this:
⚠️ MALICIOUS TRANSACTION DETECTED
Risk: HIGH
Function: 0x095ea7b3
Data: 0x095ea7b3000000000000000000000000deadbeef...
To a developer, this means: "Unlimited approval to a suspicious address."
To a normal user, this means: "I have no idea what this says. I'll just click Ignore."
And that's exactly what happens. Users experience alert fatigue. They see scary-looking warnings they don't understand, and eventually they start ignoring them entirely. Or worse—they disable the security tool altogether because it "keeps interrupting them."
This is the dirty secret of crypto security tools: they're built by security engineers, for security engineers.
The mass market—the regular people these tools claim to protect—can't use them effectively.
The "False Sense of Security" Problem
There's a second, deeper flaw: blacklist dependency.
Most existing tools check transactions against a database of known bad addresses. If the address isn't on the list, the tool says "Safe."
But scammers create new addresses every single minute. A brand-new scammer address won't be on any blacklist yet. The tool says "Safe"—and the user gets drained anyway.
This creates a false sense of security. Users trust the tool, the tool gives them a green light, and they lose everything.
The system is reactive, not proactive. It waits for someone to lose money, then adds the address to a list. That's not protection—that's a obituary.
The Solution: Visual Storytelling
I realized the answer wasn't a better database—it was a better language.
Instead of showing users hex codes and function signatures, what if we showed them the consequence?
Instead of:
Error: 0x095ea7b3...
Show them:
- Now: You click Sign.
- +2 Seconds: Site gets Unlimited Access.
- +10 Seconds: Wallet Drained. Balance: $0.
This is the "Time-Travel UI" concept. It doesn't ask users to understand bytecode. It shows them what happens next.
When a user sees a visual timeline of their wallet being drained, they don't need to understand setApprovalForAll or approve(spender, MAX_UINT). They understand "drained." They understand "$0." They understand "don't click."
Visual storytelling beats technical jargon. Every time.
The Philosophy: Security as a Public Good
As I built SafeSign, I made three core decisions that shape everything:
1. Proactive, Not Reactive
SafeSign doesn't just check blacklists. It analyzes the logic of the transaction. If a contract asks for unlimited approval, SafeSign blocks it—even if the address is brand new and not on any list. It catches zero-day scams by understanding what the code does, not just who submitted it.
2. Privacy-First, Always
No data collection. No tracking. No backend. Every analysis happens locally in the browser. Your wallet history, your transaction data, your browsing habits—none of it leaves your machine. Security tools shouldn't require you to surrender your privacy to be protected.
3. Open-Source, Transparent
The entire codebase is on GitHub. Anyone can read every line. Anyone can verify there's no malicious behavior. Anyone can fork it, improve it, or audit it. In crypto, the rule is "don't trust, verify." I take that literally.
What SafeSign Actually Does
Since launching, SafeSign has grown into a comprehensive security layer:
- Unlimited Approval Blocks (ERC-20 token drains)
- NFT Collection Drain Blocks (setApprovalForAll)
- Gasless Permit Drain Blocks (EIP-2612 fake login scams)
- Address Poisoning Detection (local, zero-database)
- Proactive Anti-Phishing (known scam sites blocked entirely)
- SIWE Domain Spoof Detection (catches fake "Sign-In With Ethereum")
- Auto-Pause on Localhost (developer-friendly)
- Visual Time-Travel UI (the core differentiator) All free. All open-source. All local.
The Mission
If you want to protect your wallet (or just want to see the Time-Travel UI in action), SafeSign is free on the Chrome Web Store.
The code is on GitHub. Read it. Fork it. Improve it.
Security should be a public good.
🔗 Links:
Chrome Web Store
GitHub
Twitter/X
This is the first in a series of devlogs about building SafeSign. Next time, I'll break down the technical architecture of how I intercept window.ethereum requests before wallet opens.
Top comments (0)