Practice attacks and defense on testnet · spot traps, reject them, revoke access
Level 1 taught you to use the wallet: address, network, gas, a transfer, approve. Level 2 teaches you not to lose funds: what typical attacks (drainers) look like, which red flags give them away, and how to close the approvals you have granted.
Go in order: first the three traps (you see the attack and the wallet's detector firing), then defense (you revoke a dangerous approval yourself), and at the end — a recap with a checklist.
The most direct trick: you are talked into entering your seed phrase yourself — fake support, "recovery", a fake wallet. Rule #1: a real wallet/site never asks for the seed. Inside — a safe practice form.
A dApp asks for an unlimited approve on your token "for a reward" — and the drainer contract takes your whole balance with one transferFrom. The red flag is the F1 detector "UNLIMITED".
permit (EIP-2612) is an off-chain signature of an approval, more dangerous than a normal approve: you pay no gas, yet you grant access. The detector shows "A permit is a permission", an unlimited value, the spender and the deadline.
An unrequested "gift" is bait. To "claim" it, you are asked to approve your real token, not the gift. The rule: do not interact with unrequested tokens, check the whole address.
The flip side: you grant an unlimited approve yourself on live testnet and revoke it (allowance ∞ → approve 0). Plus hygiene: Etherscan "Token Approvals", revoke.cash.
The attacker "poisons" your history with a transfer from a look-alike address: the start and end match, the middle differs. Copy the recipient from history — and the money goes to them. We learn to check the whole address and catch the flag.
The hat over all the traps: one habit of checking before a signature and a send — address, site, signature request, token. At the end — an interactive "spot the catch".
Four situations — one habit: read the wallet window. In three of them your access to funds is lured away (approve/permit/airdrop), in the fourth the recipient is swapped (a look-alike address). Recognize the red flag, reject it, and revoke what you have already granted.
Takeaway: an approve and a signature are a key you hand out, not an "OK button". Grant the minimum per operation, revoke afterwards, and periodically check the list of granted approvals (Etherscan "Token Approvals", revoke.cash — only via a verified bookmark; a real tool never asks for the seed phrase).