The attacks that drain wallets.
How Intentra stops them.

When you use a DeFi app for the first time, it asks you to "approve" it to spend your tokens. Legitimate apps request exactly what they need.

Drainer apps request the maximum possible amount — every token you'll ever have, forever. Once approved, the attacker can drain your wallet anytime, even while you sleep.

Intentra inspects every approval transaction before it reaches your wallet. If the amount equals MAX_UINT256 (or any equivalent maximum), it flags it as UNLIMITED_APPROVAL.

This is a hard rule — it cannot be bypassed by changing security mode. No configuration disables it.

A newer, more dangerous version of the approval attack. Instead of a transaction, the site asks you to "sign a message" — which feels harmless, like logging in.

That signature is a Permit: a cryptographically valid authorization that lets the attacker drain your tokens with no further action from you. No gas. No second confirmation.

Intentra intercepts signature requests, not just transactions. When a site requests a typed signature (eth_signTypedData), Intentra decodes the hidden contents and checks for Permit structures.

If the permit value is MAX_UINT256 or the expiry deadline is excessively long, the request is blocked before you can sign.

Once a malicious site has partial wallet access, an automated script fires multiple transactions in rapid succession — trying to move assets before you can react.

The speed is intentional: human reaction time is ~500ms. Scripts operate in milliseconds. By the time you see anything happen, it may be over.

Intentra tracks transactions per minute in real time. When the rate exceeds your configured threshold (default: 5 TX/min), it automatically activates the emergency kill switch.

The kill switch blocks all further transactions until you manually reset it. The UI turns orange to alert you immediately. This is the very first check Intentra runs — before any other rule.

Many DeFi protocols use upgradeable proxy contracts — the address you approve stays the same, but the underlying logic can be silently replaced. You approved a safe contract. The attacker upgrades it to malicious code. Your existing approval now grants access to logic you never reviewed — and never had a chance to reject.

Intentra checks every contract interaction against known proxy patterns. When the destination address contains a delegatecall structure or matches known upgradeable proxy signatures (EIP-1967, EIP-897), the transaction is flagged for review before it reaches your wallet.

Attackers create artificial urgency — "claim your airdrop in 60 seconds," "your position is being liquidated" — to make you send large ETH amounts without reading carefully.

This also covers honest mistakes: mistyping an amount, approving the wrong field, or clicking confirm while distracted.

Any native ETH transfer above your configured threshold (default: 0.5 ETH) triggers the overlay with a clear breakdown: destination address, exact amount, and a warning that this exceeds your limit.

The overlay interrupts the urgency — giving you the seconds needed to actually read what you're signing.

Multiple small transactions that individually look harmless can add up to significant losses in a single session. Attackers exploit this by spacing transactions just far enough apart to avoid velocity detection.

Without a daily cap, a session starting with a legitimate 0.5 ETH swap could end with 8 ETH moved to attacker addresses across 6 separate transactions.

Intentra tracks the total ETH moved since midnight. When a new transaction would push that total above your configured daily hard cap (default: 10 ETH), it is denied automatically.

Even if you approve each individual transaction, the daily cap cannot be exceeded without manually adjusting your settings.

Most crypto losses happen on the first interaction with a contract. The user has no history with it — and attackers know this is the moment of maximum vulnerability.

Phishing sites, rug pulls, and fake token claims all rely on getting you to sign one transaction with a contract you've never touched before.

Intentra maintains a history of every contract you've successfully interacted with. Any contract not in your history and not on the trusted seed whitelist triggers an overlay showing the address and a first-use warning.

Once you interact with a contract safely, it joins your trusted list — future interactions pass without friction.

The most dangerous combination: a large ETH amount sent to a contract you've never interacted with. This is the signature of fake investment platforms, bridge scams, and "guaranteed yield" traps.

Legitimate protocols rarely ask for significant ETH on your first interaction. Scams almost always do.

When both conditions are true — ETH value above your contract call threshold AND the destination is not in your trusted list — Intentra flags it as HIGH_VALUE_CONTRACT_CALL.

The overlay shows the exact ETH amount, the unknown contract address, and a clear warning about the combination of risk factors present.

For users managing significant holdings, even trusted contracts can be compromised. A protocol you've used 50 times safely might have its contract upgraded to a malicious version overnight.

In high-stakes situations, every transaction deserves a deliberate human review — regardless of history.

In Paranoid mode, CONTRACT_CALL_PARANOID is added to every single contract interaction — known or unknown, high or low value. No interaction passes silently.

Every transaction gets the overlay. You confirm every action deliberately. Nothing moves without your eyes on it.

A newer Ethereum feature (EIP-7702) allows wallets to delegate their behavior to a smart contract. This enables powerful features — but also a dangerous new attack vector.

An attacker tricks you into delegating your wallet to a malicious contract. Once delegated, every transaction you make passes through attacker-controlled logic that can redirect funds without your knowledge.

Before every native ETH transfer, Intentra checks the destination address's bytecode via eth_getCode. If it starts with 0xef0100 — the EIP-7702 delegation prefix — the transaction is flagged immediately and routed to mandatory review before you can sign.

Full SET_CODE transaction interception — blocking the delegation at the moment it's created — is in active development for V2.