Three transfers. Three verdicts.
The drainer
The scene
A signed contract call sends 4.7392 ETH and uses an existing USDC allowance in the same transaction.
Protocol-valid illustrative payloadThe wallet exposes the top-level value and an unknown method. It does not show the internal token pull.
Simulated asset changes
- ETH
- −4.7392
- USDC
- −186,420.73
- Recipient
- Same unknown address
- Permission path
- Existing allowance consumed
- Intent
- Mismatch
Pre-broadcastNormalized evidence
Block
- Reason
- Multi-asset outflow · intent mismatch
- Enforcement
- DO_NOT_BROADCAST
The Permit2 batch
The scene
A signed Universal Router transaction contains a Permit2 batch for four listed tokens and one spender.
Protocol-valid illustrative payloadA normal-looking contract interaction. The wallet does not surface the token-by-token permissions inside it.
Decoded permissions
- Permit2
- 0x0000…78BA3
- Operation
- PermitBatch
- Tokens
- 4 listed assets
- Spender
- 0x66a9…dBA8Af
- Allowance expiry
- 30 days
- Scope
- Multiple high-value allowances
Pre-broadcastNormalized evidence
Hold
- Reason
- Batch permissions require review
- Enforcement
- DO_NOT_BROADCAST
The everyday transfer
The scene
A signed ERC-20 transfer sends 247.83 USDC to a known recipient.
Protocol-valid illustrative payloadA standard transfer confirmation — recipient and amount exactly as expected.
Simulated asset changes
- USDC
- −247.83
- Recipient
- Known address
- Extra movements
- None
- Permission changes
- None
- Intent
- Matched
Pre-broadcastNormalized evidence
Allow
- Reason
- Declared transfer matches outcome
- Enforcement
- PROCEED