3

When interacting with smart contracts via MetaMask, what does it mean when the wallet tells you "We cannot verify this contract. Make sure you trust this address"?

See an example of the warning below:

enter image description here

Even more confusing is that the name of the function you're interacting with (in this case, the simpleSwap() function from ParaSwap), is being decoded alright (which is what I'd expect to not be possible to do without a "verification" of the contract).

2 Answers 2

2

It's a misleading message. It is meant to notify the user that this contract is not endorsed by Metamask, and actually, Metamask does not know about the contract and whether it's malicious or not. It has nothing to do about source code verification.

Also discussed here: https://github.com/MetaMask/metamask-extension/issues/15456

1
  • 1
    Thank you for the referrence to the related MetaMask GitHub issue! Accepted your answer.
    – Iaroslav
    Commented Jun 3, 2023 at 13:44
0

Without being sure, my guess is that the contract's source code hasn't been verified in services such as Etherscan. However, even if Metamask could see the source code, it wouldn't really be able to determine if the contract is malicious or not. So, in the end, I'm really not sure what that warning means.

The reason why you can see the function name is that your transaction includes the function's signature hash. The hash can then be checked in a service such as https://github.com/ethereum-lists/4bytes or https://www.4byte.directory/ (although this seems to be down right now). So Metamask can reverse engineer the function name based on your contract call payload.

2
  • 1
    The source code of the contract from the screenshot above has, actually, been verified on Etherscan. Feel free to check it out @ 0xDEF171Fe48CF0115B1d80b88dc8eAB59176FEe57. On another note: if the function signature included in the tx can easily be reverse-engineered to the name of the function, why don't wallets always show us the function name? For example, I've just tried initiating a swap via ParaSwap on Ethereum, Polygon and Fantom - and the function was only identified as "CONTRACT INTERACTION" on Ethereum (while it correctly appeared as "simple swap" on the other two).
    – Iaroslav
    Commented Apr 25, 2023 at 17:31
  • In some cases the signature hash simply doesn't have a known reverse mapping in databases. But in general, don't really know how wallets work in this regard. Commented Apr 26, 2023 at 5:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.