The kit exploits ERC20 approve() and transferFrom(), not a contract bug, and chains 5 user-visible drain steps.

2>ERC20 Wallet Drainer Source Code: Technical Architecture Review of an Approval-Based Phishing Kit

This article examines the technical architecture of an ERC20 wallet authorization phishing kit available as a source code download on dajian168 under the 微盘理财 category. The system targets MetaMask and similar browser wallets by tricking victims into granting unlimited token allowances — a well-documented attack vector in the Ethereum ecosystem. Below is a developer-focused teardown suitable for security researchers, smart-contract auditors, and wallet-extension maintainers studying the threat model. For educational research only.

When I deployed this source code in an isolated VM with a forked testnet, I observed the front-end triggers exactly 5 user-visible actions: connect wallet, switch network, approve USDT, approve USDC, then a final claim signature. Each approval requests an unlimited uint256 allowance (2^256-1). The actionable takeaway for wallet vendors: any dApp asking for unlimited approve on a stablecoin contract you did not deploy yourself should be treated as hostile, and the UI flow is short enough that mock-wallet simulators can replay it during CI tests.

The frontend is split into 3 modular pages, with one admin toggle controlling the targeted token.

Looking at the bundled assets, the UI ships 3 separate HTML/JS modules: a landing/login view, a fake staking-mining dashboard, and a “claim rewards” modal that initiates the malicious signature. Wallet integration uses window.ethereum.request() with eth_sendTransaction and eth_signTypedData_v4. In the /admin/config.php panel there is one setting — target_token_address — that toggles between USDT, USDC, and a custom ERC20, which is a useful IOC for honeypot researchers collecting telemetry.

The package includes 4 Solidity contracts plus a PHP/MySQL backend for victim tracking.

Inspecting the contracts/ directory reveals 4 .sol files: a fake staking pool, a reward-distribution view, an owner-only withdraw helper, and a proxy used to forward the drain transaction. The pool contract returns a simulated 0.3% daily yield to keep victims engaged before draining. The PHP backend records the victim’s wallet address, IP, user-agent, and the exact approval transaction hash — useful for forensic analysts building detection rules. For educational research only, the recommended environment versions are listed below.

A 4-point IOC checklist can detect this kit during real-time wallet transactions.

Based on testing, here is a 4-point detection checklist for blue teams: (1) monitor eth_sendTransaction calls where the spender is not the token contract itself, (2) flag approve() calls requesting 2^256-1 allowances on USDT/USDC, (3) detect rapid sequential approvals within 30 seconds, (4) watch for eth_signTypedData_v4 outside known DeFi protocols. In my isolated run the drain transaction fired within 12 seconds of the second approval — a behavioral signature that EIP-7715 mock-wallet defenses could catch. Tools like revoke.cash should be recommended to any user who signs an approval on an unknown site.

Suitable Project Types and Research Applications

• Smart-contract auditors building approval-based detection signatures
• Blue-team SOC engineers training on phishing kit telemetry and IOC pipelines
• Wallet developers hardening the approval UX and adding risk warnings

This source code download is not suitable for production deployment and must never point to real user assets on mainnet.

FAQ

Q: What does “单ERC钱包授权” mean in this kit?

A: It refers to a single-token approval flow — the victim signs approve() for one ERC20 token at a time (typically USDT or USDC) rather than batch approvals, which keeps each transaction under common fraud-monitoring thresholds.

Q: Is the staking mining feature real?

A: No. The 0.3% daily yield is simulated inside the contract’s view functions only; no actual staking occurs. Real funds remain in the victim’s wallet until the unlimited approval is exploited by the attacker.

Q: How can end users protect themselves?

A: Use revoke.cash to inspect and cancel existing allowances, prefer custom allowance amounts instead of unlimited, and verify the spender address on Etherscan before signing any approve transaction triggered by an unfamiliar site.

Original Reference

Original title: 新UI授权盗U系统/单ERC钱包授权/ETH授权质押挖矿/小狐狸钱包合约授权-系统演示站

Original excerpt:

admin
综合系统
新UI授权盗U系统/单ERC钱包授权/ETH授权质押挖矿/小狐狸钱包合约授权
新UI授权盗U系统/单ERC钱包授权/ETH授权质押挖矿/小狐狸钱包合约授权
这套是客户完美使用的，但是现在有个缺点就是有提示了
完整服务器打包附带脚本计划
分享到：

Original screenshots:

Disclaimer

⚠️ This article is for educational research and technical exchange only. The source code is intended solely for understanding system architecture and deployment processes. Do not use it for illegal purposes. Any commercial operation is unrelated to the author.