That address in your wallet history might not be the one you think. ⚠️
Address poisoning keeps working because wallets show the first and last few characters of an address, and that's what people check. The attacker matches those ends, drops a dust transfer into your history, and waits for
Address poisoning keeps working because wallets show the first and last few characters of an address, and that's what people check. The attacker matches those ends, drops a dust transfer into your history, and waits for a copy-paste.
Global MPC built address-guard to check a destination before sending:
- Trusted recipients come only from your own outgoing transfers: successful, non-zero, signed by you, with the recipient named in your calldata. A poisoned inbound transfer can't make an address trusted.
- A destination that shares the first and last 4 hex characters with a trusted recipient but differs in the middle is flagged as a look-alike.
- EIP-55 checksum check.
- CLI exit codes (0 trusted, 10 new, 20 look-alike, 30 invalid) so a payout CSV can gate a CI job.
What it doesn't do: a brand-new malicious address is "new", not flagged. Payments via multisend or Safe don't build trust. ERC-20 on EVM only.
Repo: https://github.com/globalmpc/rwa-kit-js (MIT)
npm: @globalmpc/address-guard
Curious how others handle this in payout pipelines. Allowlists? Manual review? Something else?
Originally published by Dev.to WebDev. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.