New ERC-20 approval to unverified contract from whale

A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.

Methodology how we score #

**What this measures** This real-time signal fires when a whale or high-TVL user (defined as a wallet with a protocol balance in the top 10% by value) grants a new ERC-20 approval to an unverified contract that is interacting with the monitored protocol. The signal is generated by monitoring approval events from high-value wallets and cross-referencing the approved contract address against Etherscan/Sourcify verification status. Category 6 context: malicious approval harvesting targeting high-value users is a documented attack pattern — the Badger DAO incident demonstrates that a 12-day window of malicious approvals being granted went unnoticed.

**Why it matters** Badger DAO ($120M, 2021) is the clearest example: malicious increaseAllowance() calls granting the attacker's address unlimited approval from high-value user wallets began approximately 12 days before the drain, and a user flagged unusual approvals before the hack occurred. The attack would have been detectable if high-value wallet approvals to unverified contracts were monitored. Similarly, Compounder Finance showed that malicious Strategy contracts were deployed and approved through a Timelock before the rug. Monitoring new approvals from whale wallets to unverified contracts provides a meaningful detection window.

**Green / Yellow / Red** Green is the baseline when no high-TVL user has granted a new approval to an unverified contract in the trailing 72 hours. Yellow fires when a new approval is granted to an unverified contract by a high-TVL user but the contract is newly deployed and may simply be unverified for benign reasons. Red fires when multiple high-TVL users grant approvals to the same unverified contract within a short window, particularly if the contract is not associated with any known legitimate protocol interaction.

**Common gray cases** Gray applies on chains where contract verification rates are low and unverified approvals are common in normal operations, or when the approval is to a known-protocol contract that happens to be deployed on a chain without full verification.

**Notable historical examples** - **Badger DAO** ($120M, 2021): Malicious increaseAllowance() calls from high-value users granting unlimited approval to attacker address; visible 12 days before the drain. - **Compounder Finance** ($12M, 2020): Malicious Strategy contracts deployed and approved through Timelock before rug; approvals were visible on-chain.

Measurement what to look for #

Detect whether a top-TVL depositor grants a new token approval to an unverified contract that interacts with this protocol.

Data & output #

Data source

Mempool `Approval` event stream + Etherscan verification status check + protocol TVL whale list

Output format

Green / Yellow / Red

Evidence artifact

Approval tx hash + approving wallet + approved contract address + verification status

Confidence signal

green = signal not firing; red = approval granted to unverified contract; gray = whale list or monitoring not configured

Scored protocols 80 carry this factor #

Protocol RD-F-096

Linked hacks 6 historical incidents #

illustrativePrismaFi — Flash Loan + Missing Input Validation (Migration Helper)2024-03-28 · $12M · Flash Loan + Missing Input Validation (Migration Helper) · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Approval of MigrateTroveZap by a monitored address 5 days before attack; migration contract was newly deployed (past week)]

illustrativeDexible — Unvalidated router — selfSwap() transferFrom injection via approval drain2023-02-17 · $2M · Unvalidated router — selfSwap() transferFrom injection via approval drain · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: None identified — the attack harvested existing approvals with no preparatory on-chain footprint beyond the attacker being funded]

illustrativeTransit Swap — Controllable transferFrom() in unverified (closed-source) swap contract — approval drain2022-10-01 · $21M · Controllable transferFrom() in unverified (closed-source) swap contract — approval drain · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Unverified (closed-source) contracts on a live swap aggregator; large-scale approval draining across multiple wallets simultaneously]

illustrativeCurve Finance (curve.fi frontend) — DNS nameserver compromise → malicious frontend injection → approval harvesting2022-08-09 · $575K · DNS nameserver compromise → malicious frontend injection → approval harvesting · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Malicious approvals being granted to unverified contract; approval to `0x9eb5f8e...` by multiple wallets in quick succession]

illustrativeBadger DAO (Bitcoin-yield vaults on Ethereum) — Front-end injection (Cloudflare account compromise) → malicious `increaseAllowance()` approvals → vault token drain2021-12-02 · $120M · Front-end injection (Cloudflare account compromise) → malicious `increaseAllowance()` approvals → vault token drain · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Y** — malicious `increaseAllowance()` calls granting attacker's address unlimited approval began ~12 days before the drain; a user flagged t...]

illustrativeCompounder Finance — Malicious Strategy Contracts — Backdoor Withdrawal (Insider Rug Pull)2020-12-02 · $12M · Malicious Strategy Contracts — Backdoor Withdrawal (Insider Rug Pull) · New ERC-20 approval to unverified contract [via realtime_signals/Pre-exploit on-chain signals: Y — the 7 malicious Strategy contracts were deployed and approved through the Timelock (24-hour delay) before the rug; these approvals were ...]

rubric_version v1.7.0 factor RD-F-096 category 6 carried 80 critical no