What to do if you have mistakenly signed a fraudulent transaction?

If you cannot find the transaction you signed here, we suggest you to not take any risks and create a completely new wallet (with a new seedphrase) and move your assets over to the new wallet.

Token Approval

There is a current method used by phishers in which the attacker obtains the wallet owner's approval to use their tokens. After gaining approval, the attacker quickly transfers and uses the funds for their own benefit.

Actions to take

Check if your approvals are dangerous on Nefture
Go to Revoke.cash
Once connected, click the 'Revoke' button to revoke the approval of the intended smart contract. Every connected smart contract will have their own 'Revoke' button. Thus, only revoke the approval of the smart contract(s) that you wish to disconnect.

Seaport Signature

Seaport's intricate signature structure makes it possible for a scammer to trick an inexperienced user into signing a malicious listing through a phishing website. This highlights the importance of making signatures and transactions more transparent for users to prevent such scams.

Offline signatures can still be dangerous in many cases, oftentimes resulting in loss of assets: This includes active OpenSea contracts.

Actions to take

If this happened to you, you must Invalidate previous Seaport Signatures.

Check if you have a seaport signature on Nefture
Go to the Seaport contract on Etherscan
Click Connect to Web3
Click "Write" under "incrementCounter" and sign

✅
You can also use Harpoon instead of Etherscan. You only have to click and sign Button 1 which does the same as above.

Generic signature (eth_sign)

Scammers may use the eth_sign method as part of a phishing attack in order to trick users into signing a message that appears to be legitimate, but is actually malicious. For example, a scammer might create a fake website that looks like a legitimate Ethereum exchange or wallet, and ask the user to sign a message using their private key as part of the login process. If the user signs the message, the scammer can then use the signed message to extract the user's private key and gain access to their Ethereum account.

To protect yourself from this type of scam, you should be cautious when signing messages and only sign messages from sources that you trust. It is also a good idea to use a hardware wallet, which stores your private keys in a secure, offline device, to sign messages and perform other sensitive actions. This can help to prevent the private keys from being compromised by malware or other malicious attacks.

Actions to take

If you did a Generic Signature, this approval can do almost anything to your wallet.

Go to Revoke.cash
Move your assets to a newly created wallet

“Upgrade to” transactions

There are several ways in which scammers may use "upgrade to" transactions to scam people:

The scammer may create a fake contract that appears to be an upgrade to a legitimate contract, but is actually designed to steal users' assets. If a user falls for the scam and sends their assets to the fake contract, the scammer can then take the assets and disappear.
The scammer may try to convince users to send their assets to a new contract that the scammer claims is an upgrade to the original contract. The scammer uses social engineering tactics, such as pretending to be a member of the development team, to trick you into thinking that the upgrade is legitimate.
The scammer may create a contract that is designed to look like an upgrade to a legitimate contract, but is actually a copy of the original contract with some malicious code added. If you fall for the scam and sends your assets to the fake contract, the malicious code may execute and steal your assets.

Actions to take

If you did this transaction, follow these simple steps.

Get your wallet audit on Nefture and check if you see Opensea (old) approvals
Go to Revoke.cash to revoke those approvals

🚧
To protect yourself from these types of scams, you should be cautious when upgrading contracts and only upgrade contracts from trusted sources. It is also a good idea to thoroughly review the code of any contract before upgrading to ensure that it is safe and legitimate.

Steps to stay safe ⛑

Understand what you're signing, don't blindly sign random signatures/transactions
Don't sign Seaport signatures outside of OpenSea
Don't trust new/random platforms
Use multiple wallets (Hot, cold, hardware)
Always confirm authenticity/identities
Check your Wallet risk score and get a monthly audit on Nefture
Use Nefture RPC that protects you against scammers and helps you understand what you're signing.

Please give us feedback in Twitter on scams to add to this list, or any other improvements you see.