Malicious contracts disguised as routine DeFi actions

The disguise

Drainer sites present a normal-looking action — swap, stake, claim — but the signature behind the button grants sweeping token access instead of doing what it says.

Reading the request

A genuine swap moves a specific amount. A malicious one requests an unlimited approval or a Permit for the full balance. The wording in the wallet is your best clue.

Defense

Slow down on unfamiliar sites. Match the signature to the action you expect. If a simple action asks for unlimited access, reject it and verify the site.