Transaction & Smart Contract Risks
Approvals, signatures, simulators, and reading what you sign.
You sign more than you think
When you interact with a Web3 app, you are not only sending transactions — you are also approving contracts, signing structured messages, and granting allowances. Each of these can move assets later, without an obvious "transfer" popup at the time.
Token approvals
An approval tells a smart contract: "you may move up to X of my tokens." Many apps default to "unlimited" approvals for convenience. That convenience becomes a liability if the contract is later exploited or upgraded maliciously.
Reading a transaction
Before signing, check three things:
Use simulators
Modern wallets (Rabby, MetaMask with simulation, Frame) and external tools (Tenderly, Pocket Universe, Blockaid integrations) preview the on-chain effect of a transaction before you sign. If the simulator says "you will lose your NFTs", that IS the answer — reject.
Off-chain signatures are not "free"
Standards like EIP-712 ("Permit"), Seaport orders or generic personal_sign let websites ask you to sign structured messages. These signatures can authorize asset transfers later, without you initiating another transaction. Read them. If the message is opaque and the site is unfamiliar, do not sign.
A wallet that does not let you preview transactions and signatures clearly is the wrong wallet for treasury work.