Advisory: Transaction-Simulation Phishing Contracts Bypassed Wallet Safety Previews Across EVM Chains

A July 28, 2026 research paper (arXiv:2607.28747) formally documented 4,224 malicious EVM contracts that exploited wallet simulation tools to show safe previews while silently redirecting funds during real broadcast, victimising 5,742 addresses for an estimated $3.48 million.

Root Cause

Wallet transaction simulators (used by MetaMask, Rainbow, Rabby, and similar tools) execute a call via eth_call against a forked state before the user signs. Simulation-phishing contracts exploit state-sensitive re-routing: the contract behaves benignly during simulation but uses a per-address flag, block-number condition, or storage bit set by a first call to divert funds during the real broadcast.

The SimGuard detector (introduced in arXiv:2607.28747) identifies these contracts by comparing bytecode execution traces under simulated vs. non-simulated conditions.

// Illustrative pattern — first call appears safe, second redirects
contract SimPhish {
    mapping(address => bool) private _interacted;

    function deposit(address recipient) external payable {
        if (!_interacted[msg.sender]) {
            // First call (simulation path): looks benign
            _interacted[msg.sender] = true;
            balances[recipient] += msg.value;
        } else {
            // Second call (real broadcast): routes to attacker
            (bool ok,) = attacker.call{value: msg.value}("");
            require(ok);
        }
    }
}

Because wallets typically simulate once then broadcast, the user sees a safe preview but the real transaction hits the second branch.

Attack Steps

#	Action
1	Attacker deploys simulation-phishing contract and promotes via fake DeFi UI / social media
2	Victim connects wallet and previews the transaction — `eth_call` simulation runs benign path
3	Wallet displays a safe or beneficial outcome (e.g., small token gain shown)
4	Victim approves; wallet broadcasts the real transaction
5	Live execution triggers the redirect branch; funds sent to attacker-controlled address
6	User receives failure or trivial return; attacker holds the drained value

Impact

4,224 simulation-phishing contracts identified, deployed between August 2024 – June 2025
5,742 victim addresses across four chains
~$3.48 million in total losses; 91.5% on Ethereum
Largest single phishing cluster: ~83% of all losses
Chains affected: Ethereum, Binance Smart Chain, Avalanche, Polygon

The research paper was formally published July 28, 2026 (arXiv:2607.28747) — the first large-scale empirical measurement of this attack class. Active contract deployment suggests the pattern remains live despite being described in earlier academic literature.

Lessons for Auditors

Test for simulation–execution divergence. Explicitly test whether contract behavior differs between eth_call and eth_sendRawTransaction paths. Look for: per-address boolean state bits reset or set during a first call; block.number/block.timestamp guards trivially passable in simulation; tx.origin vs msg.sender branching; gas-sensitive conditionals.
Flag unverified contracts immediately. Chainalysis data shows unverified bytecode is disproportionately used in phishing attacks. Any unverified contract in audit scope should be treated as high-risk until source is confirmed.
Re-simulation recommendation. Wallets should re-simulate with the actual gas limit and gas price from the broadcast request, and test current-and-next block-number/timestamp inputs to catch time-gated redirects.
State-bit detection heuristic. Contracts that write a per-caller boolean flag in one function and read it in another — with different execution outcomes — are a strong simulation-phishing indicator. This pattern is detectable by static analysis.