Preview · see what happens before you sign

WHAT IS THIS?

📋

1. PasteA link to a transaction, or your wallet address.

🧪

2. I test-run itIn a practice copy of the blockchain. Nothing real happens, nothing leaves your wallet.

🛑

3. You get the truthOne clear answer: fine, careful, or don't do it.

WHAT WILL THIS DO TO MY WALLET?

works with: an etherscan.io transaction link · a transaction code (0x… 66 characters) · a wallet address (0x… 42 characters) to see what's been happening to it.

advanced: i have the raw transaction

paste the request your wallet shows (JSON with from/to/value/data), or fill these in. this is what the X-Ray eats too.

FOR THE NERDS · SCORECARD

i replayed real transactions that people signed right before getting drained (addresses from my drainer map), each one against the blockchain exactly as it was one block before. two scores: what i'd have said on the day with no scam lists at all (just the practice run + common sense rules), and with today's scam lists (that's hindsight, so it's the easy mode).

HOW IT WORKS

1. the practice run. your browser calls eth_simulateV1 (with traceTransfers) on a free public node (drpc.org, fallback publicnode). it executes the transaction on top of real mainnet state without broadcasting anything. no keys, no server of mine in the loop for this part.
2. the receipt. i read the events the run emits: ERC-20 Transfer/Approval, ERC-721 Transfer, ApprovalForAll, ERC-1155 transfers, plus native ETH moves (traceTransfers turns those into logs too). anything leaving or entering your address goes on the receipt. USD values use DefiLlama's current prices.
3. the verdict. receipt + X-Ray decoding of the call + flags from my drainer map and ScamSniffer's list + simple rules: "all your NFTs to a non-marketplace" = red, unlimited token permission to an unknown address = red, sending value and getting nothing back = yellow.
4. links & hashes. a transaction hash or etherscan link gets replayed at the block before it landed (needs an archive node; drpc serves that free). a wallet address shows its last 25 transactions via my Etherscan proxy (key stays server-side), each one checkable.
source: preview/engine.js (MIT) · replays.json (CC0). inspired by Vitalik's call for wallet-side simulations and the EF's Clear Signing / ERC-7730 push. this is a free, open, independent take on the same idea.

LIMITS (READ THESE)

off-chain signatures aren't transactions. permit / Seaport / "sign-in" messages don't run until the drainer submits them, so there's nothing to test-run. use the X-Ray for those. the scorecard counts these as misses.
the practice run is against state now (or the block before, for links). a contract can behave differently later, or detect it's being simulated.
a permission (approval) moves nothing by itself. Preview flags it, but the theft happens later, in a different transaction.
prices are today's, not the day of the drain. NFTs have no USD value here.
public free nodes can rate-limit or go down. if it fails, try again in a minute.
ethereum mainnet only. not financial advice. not an audit.

EVERY REPLAY

← back to the lab · signature x-ray · drainer map · proof of haze