Free tool
Check any signature before you sign it
Paste what your wallet, or your signing system, is about to sign. CryptGuard decodes it, simulates it on a live chain and tells you what our Co-Signer would decide. Try a replay of a real attack.
Patterns the engine recognises
- EIP-7702 takeovers: delegations to unknown contracts,
chainId 0(valid on every chain) and batches pre-signed for future nonces, as in the Binance drain. - Multisig hijacks: Safe
execTransactionwith DELEGATECALL, owner, threshold, module and guard changes, and malicious MultiSend batches. - Drainer signatures: EIP-2612 permits, Permit2 single and batch approvals, signature transfers, and zero-price Seaport listings.
- Unlimited approvals and NFT operator grants, with known protocols labelled.
- Swap hijacks: DEX swaps whose output goes to someone else, or with no minimum output.
- Blind signing:
eth_sign, raw 32-byte hashes and Sign-In with Ethereum requests from the wrong domain.
Live simulation uses eth_simulateV1 against the latest block to show exactly which assets would leave your wallet and which approvals would be granted.
FAQ
Frequently asked questions
What can I paste into the inspector?
Raw calldata, a transaction object
{to, value, data}, EIP-712 typed data (permits, Permit2, Seaport orders), EIP-7702 authorizations, a wallet_sendCalls batch, or any wallet request {method, params} including personal_sign and eth_sign.Is my data sent to a server?
Decoding and risk analysis run entirely in your browser. Only if you choose to simulate is the transaction sent to a public node via our server, and only unknown function selectors are looked up in a public signature database.
What does the Co-Signer decision mean?
ALLOW means routine. WARN means signable with care. HOLD means a second person should confirm out-of-band. BLOCK means a critical attack pattern was detected. Businesses can enforce these decisions automatically with the Co-Signer API.
How does it detect the Bybit attack?
Bybit signers approved a Safe
execTransaction with operation = 1 (DELEGATECALL) to an attacker contract. The inner call looked like a transfer but rewrote the wallet. CryptGuard decodes nested calls and flags any delegatecall outside the official Safe MultiSend contracts.Get this check in your browser automatically
The Pre-Sign Firewall extension runs this engine on every request before your wallet opens, and blocks drainers before you can click confirm.