Skip to main content

Malicious Contracts Icon

Malicious Smart Contracts

Smart contracts control token movements and DeFi operations. Malicious or buggy contracts can drain your funds if you interact without verification.

Common Contract Exploits​

  • Hidden Drain Functions: Code that allows an attacker to transfer user funds.
  • Upgradable Proxy Risks: Proxies with malicious implementation changes.
  • Unverified Code: Contracts without source published on Etherscan.

How to Verify Contracts​

  1. Check Etherscan Verification: Ensure the contract’s source code is verified and matches official repositories.
  2. Review Transaction History: On Etherscan, look at past interactions to see if the contract has unusual behavior.
  3. Audit Reports: Use DeFiSafety or official audit summaries to confirm a contract has been professionally reviewed.

Best Practices​

  • Interact via Official Interfaces: Use links from Compound’s website or GitHub.
  • Use Scanning Tools: Extensions like MythX or Slither for developer-level scans.
  • Limit Approvals: Never approve unlimited allowances on untrusted contracts.

Next Steps​

Continue to Impersonation Scams to learn how to spot social engineering attacks.