New ERC-20 approval to unverified contract from whale

A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.

Methodology how we score#

What this measures
This real-time signal fires when a whale or high-TVL user (defined as a wallet with a protocol balance in the top 10% by value) grants a new ERC-20 approval to an unverified contract that is interacting with the monitored protocol. The signal is generated by monitoring approval events from high-value wallets and cross-referencing the approved contract address against Etherscan/Sourcify verification status. Category 6 context: malicious approval harvesting targeting high-value users is a documented attack pattern — the Badger DAO incident demonstrates that a 12-day window of malicious approvals being granted went unnoticed.

Why it matters
Badger DAO ($120M, 2021) is the clearest example: malicious increaseAllowance() calls granting the attacker's address unlimited approval from high-value user wallets began approximately 12 days before the drain, and a user flagged unusual approvals before the hack occurred. The attack would have been detectable if high-value wallet approvals to unverified contracts were monitored. Similarly, Compounder Finance showed that malicious Strategy contracts were deployed and approved through a Timelock before the rug. Monitoring new approvals from whale wallets to unverified contracts provides a meaningful detection window.

Green / Yellow / Red
Green is the baseline when no high-TVL user has granted a new approval to an unverified contract in the trailing 72 hours. Yellow fires when a new approval is granted to an unverified contract by a high-TVL user but the contract is newly deployed and may simply be unverified for benign reasons. Red fires when multiple high-TVL users grant approvals to the same unverified contract within a short window, particularly if the contract is not associated with any known legitimate protocol interaction.

Common gray cases
Gray applies on chains where contract verification rates are low and unverified approvals are common in normal operations, or when the approval is to a known-protocol contract that happens to be deployed on a chain without full verification.

Notable historical examples
- Badger DAO ($120M, 2021): Malicious increaseAllowance() calls from high-value users granting unlimited approval to attacker address; visible 12 days before the drain.
- Compounder Finance ($12M, 2020): Malicious Strategy contracts deployed and approved through Timelock before rug; approvals were visible on-chain.

Measurement what to look for#

Detect whether a top-TVL depositor grants a new token approval to an unverified contract that interacts with this protocol.

Data & output #

Data source

Mempool `Approval` event stream + Etherscan verification status check + protocol TVL whale list

Output format

Green / Yellow / Red

Evidence artifact

Approval tx hash + approving wallet + approved contract address + verification status

Confidence signal

green = signal not firing; red = approval granted to unverified contract; gray = whale list or monitoring not configured

Scored protocols 0 carry this factor#

No protocols have been scored for this factor yet.

Linked hacks 6 historical incidents#

illustrativePrismaFi: Flash Loan + Missing Input Validation (Migration Helper)2024-03-28 · $12M · Flash Loan + Missing Input Validation (Migration Helper) · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Approval of MigrateTroveZap by a monitored address 5 days before attack; migration contract was newly deployed (past week)]

illustrativeDexible: Unvalidated router — selfSwap() transferFrom injection via approval drain2023-02-17 · $2M · Unvalidated router — selfSwap() transferFrom injection via approval drain · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: None identified — the attack harvested existing approvals with no preparatory on-chain footprint beyond the attacker being funded]

illustrativeTransit Swap: Controllable transferFrom() in unverified (closed-source) swap contract — approval drain2022-10-01 · $21M · Controllable transferFrom() in unverified (closed-source) swap contract — approval drain · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Unverified (closed-source) contracts on a live swap aggregator; large-scale approval draining across multiple wallets simultaneously]

illustrativeCurve Finance (curve.fi frontend): DNS nameserver compromise → malicious frontend injection → approval harvesting2022-08-09 · $575K · DNS nameserver compromise → malicious frontend injection → approval harvesting · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Malicious approvals being granted to unverified contract; approval to `0x9eb5f8e...` by multiple wallets in quick succession]

illustrativeBadger DAO (Bitcoin-yield vaults on Ethereum): Front-end injection (Cloudflare account compromise) → malicious `increaseAllowance()` approvals → vault token drain2021-12-02 · $120M · Front-end injection (Cloudflare account compromise) → malicious `increaseAllowance()` approvals → vault token drain · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Y** — malicious `increaseAllowance()` calls granting attacker's address unlimited approval began ~12 days before the drain; a user flagged t...]

illustrativeCompounder Finance: Malicious Strategy Contracts — Backdoor Withdrawal (Insider Rug Pull)2020-12-02 · $12M · Malicious Strategy Contracts — Backdoor Withdrawal (Insider Rug Pull) · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Y — the 7 malicious Strategy contracts were deployed and approved through the Timelock (24-hour delay) before the rug; these approvals were ...]

rubric_version v1.7.0factor RD-F-096category 6carried 0critical no