expand on the work in #98 to show more types of warnings in that reserved space warning element #114

New Issue

sneak · 2026-03-01T00:57:18+01:00

sneak commented

2026-03-01 00:57:18 +01:00

We'll want to warn based on:

sending to an address with no history at all (done)
sending directly to a contract address
sending to a known scam/fraud address (hardcode a big list in constants)
sending to a null/burn address
any other suggestions?

you can begin work on this by finding a source for a big list of scam/spam/fraud addresses that we can bundle in. (we can also use it, if it includes scam/spam/fraud contracts, to warn the user when they attempt to add a sketchy token by contract address. we won't stop them, but we can warn them clearly.)

We'll want to warn based on: - sending to an address with no history at all (done) - sending directly to a contract address - sending to a known scam/fraud address (hardcode a big list in constants) - sending to a null/burn address - any other suggestions? you can begin work on this by finding a source for a big list of scam/spam/fraud addresses that we can bundle in. (we can also use it, if it includes scam/spam/fraud contracts, to warn the user when they attempt to add a sketchy token by contract address. we won't stop them, but we can warn them clearly.)

sneak added the

bot

label 2026-03-01 00:57:18 +01:00

clawbot self-assigned this 2026-03-01 01:04:29 +01:00

clawbot commented

2026-03-01 01:05:21 +01:00

Scam Address List Research

I evaluated two main open-source sources:

1. MyEtherWallet/ethereum-lists — `addresses-darklist.json`

Source: https://github.com/MyEtherWallet/ethereum-lists/blob/master/src/addresses/addresses-darklist.json
License: MIT
Address count: 715 addresses
Format: JSON array of {address, comment, date} objects, lowercase hex with 0x prefix
Includes scam contracts: Yes (some entries are contract addresses like fake tokens)
Pros: Clean JSON, easy to embed, well-maintained by MEW team, MIT license

2. CryptoScamDB/EtherScamDB — `scams.yaml`

Source: https://github.com/CryptoScamDB/EtherScamDB/blob/master/_data/scams.yaml
License: MIT
Address count: ~2,950 unique 0x addresses across ~2,700 scam entries
Format: YAML with nested structure (id, name, url, category, addresses array)
Includes scam contracts: Yes, includes fake ICO contracts, phishing wallets, etc.
Pros: Larger dataset, categorized (Phishing, Fake ICO, Scamming, etc.)
Cons: YAML needs parsing/extraction, some entries lack addresses (URL-only phishing)

Recommendation

I will use MyEtherWallet/ethereum-lists darklist (715 addresses) as the primary source. It is:

Clean JSON, trivial to convert to a JS constant
MIT licensed
Reasonable size for bundling in an extension (~30KB as a Set)
Well-known and trusted source

We can always expand with CryptoScamDB addresses later if desired.

Proceeding to implementation.

## Scam Address List Research I evaluated two main open-source sources: ### 1. MyEtherWallet/ethereum-lists — `addresses-darklist.json` - **Source:** https://github.com/MyEtherWallet/ethereum-lists/blob/master/src/addresses/addresses-darklist.json - **License:** MIT - **Address count:** 715 addresses - **Format:** JSON array of `{address, comment, date}` objects, lowercase hex with `0x` prefix - **Includes scam contracts:** Yes (some entries are contract addresses like fake tokens) - **Pros:** Clean JSON, easy to embed, well-maintained by MEW team, MIT license ### 2. CryptoScamDB/EtherScamDB — `scams.yaml` - **Source:** https://github.com/CryptoScamDB/EtherScamDB/blob/master/_data/scams.yaml - **License:** MIT - **Address count:** ~2,950 unique `0x` addresses across ~2,700 scam entries - **Format:** YAML with nested structure (id, name, url, category, addresses array) - **Includes scam contracts:** Yes, includes fake ICO contracts, phishing wallets, etc. - **Pros:** Larger dataset, categorized (Phishing, Fake ICO, Scamming, etc.) - **Cons:** YAML needs parsing/extraction, some entries lack addresses (URL-only phishing) ### Recommendation I will use **MyEtherWallet/ethereum-lists darklist** (715 addresses) as the primary source. It is: - Clean JSON, trivial to convert to a JS constant - MIT licensed - Reasonable size for bundling in an extension (~30KB as a Set) - Well-known and trusted source We can always expand with CryptoScamDB addresses later if desired. Proceeding to implementation.

clawbot referenced this issue from a commit

2026-03-01 01:07:45 +01:00

feat: expand confirm-tx warnings for contracts, burn addrs, scam list

clawbot referenced a pull request that will close this issue

2026-03-01 01:07:57 +01:00

feat: expand confirm-tx warnings — closes #114 #118

clawbot removed their assignment 2026-03-01 01:08:15 +01:00

sneak commented

2026-03-01 01:08:29 +01:00

Get all of them, combine them into our own list in json.

clawbot self-assigned this 2026-03-01 01:08:44 +01:00

clawbot removed their assignment 2026-03-01 01:09:19 +01:00