Problem
WalletBeat scam-alert fixtures include infinite ERC-20 approvals and EIP-2612 permit signatures. Deckard can route approve/typed-data through approval, but it does not yet elevate infinite allowance/spender risk as a first-class warning.
Scope
- Detect unlimited or unusually large ERC-20
approve(address,uint256) values.
- Detect EIP-2612/Permit-style typed data and show owner/spender/value/deadline risk rows.
- Warn on infinite allowance and long deadlines.
- Keep
eth_sign refused.
Acceptance criteria
- WalletBeat
allow-infinite-usdc and allow-infinite-permit have positive warning coverage.
- Local-chain QA proves the warning/refusal behavior with throwaway accounts only.
Problem
WalletBeat scam-alert fixtures include infinite ERC-20 approvals and EIP-2612 permit signatures. Deckard can route approve/typed-data through approval, but it does not yet elevate infinite allowance/spender risk as a first-class warning.
Scope
approve(address,uint256)values.eth_signrefused.Acceptance criteria
allow-infinite-usdcandallow-infinite-permithave positive warning coverage.