sending to an address with no history at all (done)
sending directly to a contract address
sending to a known scam/fraud address (hardcode a big list in constants)
sending to a null/burn address
any other suggestions?
you can begin work on this by finding a source for a big list of scam/spam/fraud addresses that we can bundle in. (we can also use it, if it includes scam/spam/fraud contracts, to warn the user when they attempt to add a sketchy token by contract address. we won't stop them, but we can warn them clearly.)
We'll want to warn based on:
- sending to an address with no history at all (done)
- sending directly to a contract address
- sending to a known scam/fraud address (hardcode a big list in constants)
- sending to a null/burn address
- any other suggestions?
you can begin work on this by finding a source for a big list of scam/spam/fraud addresses that we can bundle in. (we can also use it, if it includes scam/spam/fraud contracts, to warn the user when they attempt to add a sketchy token by contract address. we won't stop them, but we can warn them clearly.)
clawbot
self-assigned this 2026-03-01 01:04:29 +01:00
Cons: YAML needs parsing/extraction, some entries lack addresses (URL-only phishing)
Recommendation
I will use MyEtherWallet/ethereum-lists darklist (715 addresses) as the primary source. It is:
Clean JSON, trivial to convert to a JS constant
MIT licensed
Reasonable size for bundling in an extension (~30KB as a Set)
Well-known and trusted source
We can always expand with CryptoScamDB addresses later if desired.
Proceeding to implementation.
## Scam Address List Research
I evaluated two main open-source sources:
### 1. MyEtherWallet/ethereum-lists — `addresses-darklist.json`
- **Source:** https://github.com/MyEtherWallet/ethereum-lists/blob/master/src/addresses/addresses-darklist.json
- **License:** MIT
- **Address count:** 715 addresses
- **Format:** JSON array of `{address, comment, date}` objects, lowercase hex with `0x` prefix
- **Includes scam contracts:** Yes (some entries are contract addresses like fake tokens)
- **Pros:** Clean JSON, easy to embed, well-maintained by MEW team, MIT license
### 2. CryptoScamDB/EtherScamDB — `scams.yaml`
- **Source:** https://github.com/CryptoScamDB/EtherScamDB/blob/master/_data/scams.yaml
- **License:** MIT
- **Address count:** ~2,950 unique `0x` addresses across ~2,700 scam entries
- **Format:** YAML with nested structure (id, name, url, category, addresses array)
- **Includes scam contracts:** Yes, includes fake ICO contracts, phishing wallets, etc.
- **Pros:** Larger dataset, categorized (Phishing, Fake ICO, Scamming, etc.)
- **Cons:** YAML needs parsing/extraction, some entries lack addresses (URL-only phishing)
### Recommendation
I will use **MyEtherWallet/ethereum-lists darklist** (715 addresses) as the primary source. It is:
- Clean JSON, trivial to convert to a JS constant
- MIT licensed
- Reasonable size for bundling in an extension (~30KB as a Set)
- Well-known and trusted source
We can always expand with CryptoScamDB addresses later if desired.
Proceeding to implementation.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
We'll want to warn based on:
you can begin work on this by finding a source for a big list of scam/spam/fraud addresses that we can bundle in. (we can also use it, if it includes scam/spam/fraud contracts, to warn the user when they attempt to add a sketchy token by contract address. we won't stop them, but we can warn them clearly.)
Scam Address List Research
I evaluated two main open-source sources:
1. MyEtherWallet/ethereum-lists —
addresses-darklist.json{address, comment, date}objects, lowercase hex with0xprefix2. CryptoScamDB/EtherScamDB —
scams.yaml0xaddresses across ~2,700 scam entriesRecommendation
I will use MyEtherWallet/ethereum-lists darklist (715 addresses) as the primary source. It is:
We can always expand with CryptoScamDB addresses later if desired.
Proceeding to implementation.
Get all of them, combine them into our own list in json.
clawbot referenced this issue2026-03-01 01:11:38 +01:00