Contract Addresses: The need to be more cautious

[AmoreJaz]

Is both contract address listed on Coinmarketcap? I wonder if CMC did a cross checking on this one before making it available in the public, this is also why I always ask the developer for the real address details to avoid problems. Be careful, there’s also a lot of fake tokens on many wallet which scammers are sending it to fool the owner of that wallet because if you do transactions with those fake tokens, your wallet will surely be in trouble.

this scenario has been the practice of scammers ever since. pancakeswap, and other DEXs, they are prone to listing fake tokens. and that is true, it is your responsibility to check the legit contract addy, otherwise, you will get rekt.
this is why the devs are providing their contract address upon listing on exchanges. if you won't verify, then that's your fault.

[1714466786]

1714466786

[1714466786]

1714466786

[bittick]

Is both contract address listed on Coinmarketcap? I wonder if CMC did a cross checking on this one before making it available in the public, this is also why I always ask the developer for the real address details to avoid problems. Be careful, there’s also a lot of fake tokens on many wallet which scammers are sending it to fool the owner of that wallet because if you do transactions with those fake tokens, your wallet will surely be in trouble.

of course the other address which is scam not gonna listed in CMC since listing in CMC also require verification, they've always been carefully selected one by one.
but the other smart contract are taking advantage of the resemblance and scams people using something like uniswap.

[vv181]

It may not be an address but it's a contract address so I think that it's still inside of this type of attack which is the address poisoning.

The contract does indeed use a vanity address as the smart contract address. But I don't understand what is their purpose to execute the scheme with the smart contract address, one plausible scenario is they expect the user to wrongly enter the intended smart contract token address, although I'm not sure how effective it is.

That's more likely the reason why they do that.

I guess everything that's related to attack means to fool the users and think that they're on the right contract address and this gives the benefit to the developer of it that has only one intention.

And that's to trick people, that's why those people that are into so much stuff in the altcoins market are the ones prone to this attack.

I have to dig deeper to see the scammer's reason, turns out they are not merely expecting a wrongly entered addres.

What they are doing is "stealing" a consumed gas fee from those who approve the contract. The approval transaction contains, gas limit increment and mints CHI tokens from the user's wallet. Thus the CHI token itself is sent to the scam contract address where after it accumulates large enough, the scammer can claim the users' consumed gas fee for a reimbursement.

This is wild, and I barely heard about this. For further reference, take a look at:

https://twitter.com/SlowMist_Team/status/1640614440294035456
https://www.reddit.com/r/ethereum/comments/128dift/scam_token_called_gpt/

[abel1337]

It may not be an address but it's a contract address so I think that it's still inside of this type of attack which is the address poisoning.

The contract does indeed use a vanity address as the smart contract address. But I don't understand what is their purpose to execute the scheme with the smart contract address, one plausible scenario is they expect the user to wrongly enter the intended smart contract token address, although I'm not sure how effective it is.

That's more likely the reason why they do that.

I guess everything that's related to attack means to fool the users and think that they're on the right contract address and this gives the benefit to the developer of it that has only one intention.

And that's to trick people, that's why those people that are into so much stuff in the altcoins market are the ones prone to this attack.

I have to dig deeper to see the scammer's reason, turns out they are not merely expecting a wrongly entered addres.

What they are doing is "stealing" a consumed gas fee from those who approve the contract. The approval transaction contains, gas limit increment and mints CHI tokens from the user's wallet. Thus the CHI token itself is sent to the scam contract address where after it accumulates large enough, the scammer can claim the users' consumed gas fee for a reimbursement.

This is wild, and I barely heard about this. For further reference, take a look at:

https://twitter.com/SlowMist_Team/status/1640614440294035456
https://www.reddit.com/r/ethereum/comments/128dift/scam_token_called_gpt/

Ohh wow, This is the first time of me seeing this kind of method that scammer use. Scammers are really doing clever moves just to scam people. I wonder if how many people think this kind of trick and someone did it as a scammer. As technology progresses, We can see that new scamming methods are born along with the improvement of technology. Most of them are just clever moves that even experienced ones won't noticed until they do a investigation against the method used. Be careful fellas! Especially on these new coins.

[piebeyb]

It's been a long time that this case has been on the BNB BSC network a lot of spam fake tokens sent to wallets randomly or actively transacting, they throw money for random sending fees to many active wallets, if you see receiving a lot of strange tokens in your wallet, never sell them on pancakeswap even though it has expensive and high value, "no free money" if you never take part in an airdrop event or anything but you get free tokens forget about it and ignore it. I will explain as follows, pay attention to the image below



Every transaction you agree to on the pancakeswap platform sells the token in question, then you see the transaction fee is very large and spends your money in the wallet you should ignore it, it will automatically buy the CHI GAStoken in the picture above and send it to the owner of the token, indirectly you share your money to them.


Cases like this are difficult to overcome because low fees will always be filled with spammers in contrast to blockchain which has expensive transaction networks so you will not find this on that network for example on the ETH network a few years ago many fake tokens then after transaction fees were expensive and went up then no more cases of counterfeit tokens, currently it only works on the BSC BNB network, so for anyone who sees a lot of strange tokens in your bnb bsc wallet, I can confirm it is a fake token.

[sunsilk]

It may not be an address but it's a contract address so I think that it's still inside of this type of attack which is the address poisoning.

The contract does indeed use a vanity address as the smart contract address. But I don't understand what is their purpose to execute the scheme with the smart contract address, one plausible scenario is they expect the user to wrongly enter the intended smart contract token address, although I'm not sure how effective it is.

That's more likely the reason why they do that.

I guess everything that's related to attack means to fool the users and think that they're on the right contract address and this gives the benefit to the developer of it that has only one intention.

And that's to trick people, that's why those people that are into so much stuff in the altcoins market are the ones prone to this attack.

I have to dig deeper to see the scammer's reason, turns out they are not merely expecting a wrongly entered addres.

What they are doing is "stealing" a consumed gas fee from those who approve the contract. The approval transaction contains, gas limit increment and mints CHI tokens from the user's wallet. Thus the CHI token itself is sent to the scam contract address where after it accumulates large enough, the scammer can claim the users' consumed gas fee for a reimbursement.

This is wild, and I barely heard about this. For further reference, take a look at:

https://twitter.com/SlowMist_Team/status/1640614440294035456
https://www.reddit.com/r/ethereum/comments/128dift/scam_token_called_gpt/

Thank you.

I haven't thought that these scammers will even be interested in robbing fees since the majority of them are into the actuality of stealing the entire funds of their victims.

I understand now the tactic of it and those that are into pump and dump tokens are likely to be victimized by this scheme. Because they can do this when many of them are attracted to new tokens.

[vv181]

I will explain as follows, pay attention to the image below



Every transaction you agree to on the pancakeswap platform sells the token in question, then you see the transaction fee is very large and spends your money in the wallet you should ignore it, it will automatically buy the CHI GAStoken in the picture above and send it to the owner of the token, indirectly you share your money to them.


Cases like this are difficult to overcome ~

That is incorrect. The transaction does not sell any tokens, neither it also buying any tokens. Instead, it mints the CHI token from the users' token approval transaction.

Simply thing to overcome this gas "stealer" scam is to not approve unknown or shady tokens/smart contracts, and verifying any particular contract is the intended one. Kindly see the reffered link I have mentioned above for further information. You can also inspect any of the fake tokens transactions, it has nothing to do with PancakeSwap smart contract transactions/calls.

When users approve this token, their wallets will increase the gas limit based on the balance. Meanwhile, the token contract uses the user's gas to mint $CHI tokens. Once the contract accumulates a large number of $CHI tokens, the malicious token contract manager can obtain the gas compensation returned when the contract is destroyed by burning the CHI tokens.

[tvplus006]

...Scammers are improving they can now use a contract address that is very much similar to the real one, so awareness is very important you should check and double the details.
One moment of carelessness and you lose your coins.

I don't understand what is the danger to my wallet? The fact that a fake coin is on the balance of my wallet does not lead to a loss of balance. To lose the deposit, you must at least allow the withdrawal of coins from your wallet, and this cannot be done without your consent.

[Xal0lex]

Now, in the wave of AI hype, there are many different clones and all sorts of projects that parasitize on well-known projects. Even if the ticker is the same, even if the name of the project is the same, you should always pay attention to the network in which the smart contract is deployed. The most popular networks for scamming well-known projects, in my opinion, is BNB. Every day there appear thousands of dubious tokens, which have zero value.

[moneystery]

This is the first case I have encountered and I am quite amazed by what these scammers are doing. They can create an address that is almost similar to the original address and that of course will fool people who carelessly look at the token address in their wallet and mistake it for the real one. So now it's important for us to be able to match the original address on CMC with the one in our wallet by means of CTRL+C and CTRL+V, if no match is found it is certain that it is a fake one

[yazher]

When it comes to Binance Smart Chain, you will often receive fake tokens that don't have any usage or anything just to be there in your wallet perhaps hoping one day you will gonna lose your focus and mistook it as a real token from your wallets. Back then, it was just a few of them but right now, there are lots and as soon as you posted your BSC address on the internet for airdrops, expect lots of fake tokens on the way to get in your wallet and the best thing to do is to ignore them and maybe create another wallet that you don't share the public address with the people.

[bitkanu]

This thing actually has been occuring since long time ago, even since uniswap was first popular then there are many fake contract address even one that's trying to impersonate the real address and right now things have gotten out of hand honestly. dex should just list the contract of tokens themselves, the users shouldn't input the contract address manually if they don't want their user get scammed.