This page demonstrates how attackers exploit the time gap between transaction simulation and
execution
For educational purposes only - exercise caution with real transactions
Scenario: The "Free NFT Claim" Trap
Imagine you receive a message claiming you're eligible for a limited edition "Early Supporter
NFT." The website looks professional and claims you only need to pay a tiny fee of 0.00001
ETH plus gas to claim this NFT.
When you connect your wallet and click the "Claim" button, your wallet shows a transaction
simulation indicating it's just a simple claim operation with a minimal fee. However, the
contract contains malicious code that can steal your assets during execution.
1
Transaction simulation is a feature in modern Web3 wallets that allows users to preview
the result of a transaction before it's executed.
2
However, there's a time gap between simulation and actual execution, which malicious
actors can exploit to deceive users.
3
Attackers can change contract states after simulation but before execution, causing the
actual transaction result to be completely different from what was simulated.
The Exploitation Mechanism
The core vulnerability lies in the time gap between transaction simulation and execution.
Malicious actors have developed phishing sites that can manipulate on-chain states during this
crucial window, leading to devastating results.
1
Attackers create a seemingly legitimate DeFi site offering "free airdrops" or other
enticing rewards.
2
When users attempt to claim the reward, the site prompts them to sign a transaction.
3
The user's wallet shows a transaction simulation indicating it's just a simple claim
operation that will only cost a small amount of ETH for gas.
4
However, after the user confirms but before the transaction is mined, the attacker's
backend rapidly changes the contract state.
5
When the transaction is finally executed, it actually transfers all assets from the
user's wallet to the attacker's address.
Real-World Examples
In 2023, multiple users lost millions of dollars interacting with seemingly legitimate DeFi
platforms. These platforms used transaction simulation spoofing to make users believe they were
executing safe transactions when they were actually authorizing completely different operations.
Protection Guidelines
To protect yourself from these sophisticated attacks, follow these guidelines:
By signing this message, you authorize the transfer of 1 ETH from your wallet.
Processing Transaction...
Please wait while your transaction is being processed.
Transaction Executed!
⚠️
Warning: Unexpected Result
The transaction outcome differs from what was shown in the simulation.
Expected (Simulation)
✅ Receive: 1x Early Supporter NFT
✅ Fee: 0.00001 ETH ($0.02)
✅ Gas fee: 0.002 ETH ($3.50)
Actual (Execution)
❌ Receive: Nothing
❌ Fee: 1 ETH ($1,750)
❌ Gas fee: 0.002 ETH ($3.50)
What Happened?
This is a Transaction Simulation Spoofing attack. Between the simulation and
execution, the attacker changed the contract state, resulting in a completely different
outcome than what was shown in the simulation.
In this case, the transaction actually approved the attacker to spend all your tokens, rather
than claiming an NFT.
MetaMask
×
簽名請求
網站：metaapes.club
操作：領取 NFT
費用：1 ETH ($1,750)
Gas 費用：~0.002 ETH ($3.50)
通過簽署此消息，您授權從您的錢包轉移 1 ETH。
處理交易中...
請稍候，您的交易正在處理中。
交易已執行！
⚠️
警告：意外結果
交易結果與模擬中顯示的不同。
預期（模擬）
✅ 收到：1個早期支持者 NFT
✅ 費用：0.00001 ETH ($0.02)
✅ Gas 費用：0.002 ETH ($3.50)
實際（執行）
❌ 收到：無
❌ 費用：1 ETH ($1,750)
❌ Gas 費用：0.002 ETH ($3.50)
發生了什麼？
這是一個交易模擬欺騙攻擊。在模擬和執行之間，攻擊者更改了合約狀態，導致結果與模擬中顯示的不同。
在這種情況下，交易實際上批准了攻擊者花費您所有的代幣，而不是領取 NFT。
MetaMask
×
签名请求
网站：metaapes.club
操作：领取 NFT
费用：1 ETH ($1,750)
Gas 费用：~0.002 ETH ($3.50)
通过签署此消息，您授权从您的钱包转移 1 ETH。
处理交易中...
请稍候，您的交易正在处理中。
交易已执行！
⚠️
警告：意外结果
交易结果与模拟中显示的不同。
预期（模拟）
✅ 收到：1个早期支持者 NFT
✅ 费用：0.00001 ETH ($0.02)
✅ Gas 费用：0.002 ETH ($3.50)
实际（执行）
❌ 收到：无
❌ 费用：1 ETH ($1,750)
❌ Gas 费用：0.002 ETH ($3.50)
发生了什么？
这是一个交易模拟欺骗攻击。在模拟和执行之间，攻击者更改了合约状态，导致结果与模拟中显示的不同。
在这种情况下，交易实际上批准了攻击者花费您所有的代币，而不是领取 NFT。
Review Simulated Transaction
MetaApes Club NFT Claim
earlyapes.xyz
Transaction Simulation
30 seconds ago
Function:claimEarlySupporter()
You will receive:1x Early Supporter NFT
Fee:0.00001 ETH ($0.02)
Gas fee:~0.002 ETH ($3.50)
Note: This simulation is based on current contract state. Actual results may
vary if contract state changes before execution.
