REVIEW 3 major objections 1 minor 1 cited by
Ethereum Crypto Wallets under Address Poisoning: How Usable and Secure Are They?
T0 review · 3 major / 1 minor · reviewed 2026-08-05 · deepseek-v4-flash
Pith's one-line read A systematic lab evaluation of 53 popular Ethereum wallets found that only 3 display an explicit warning if a user tries to send funds to an address planted in their transaction history by an address-poisoning attack, while 16 wallets openl
desk verdict A useful empirical first cut at wallet-side defenses against address poisoning, but the headline numbers need a careful look at the simulation and the definition of 'protection' before they become claims. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The key mechanism is the simulated address-poisoning attack, run through each wallet's own user interface. The authors create a look-alike address that visually resembles a legitimate recipient, attach a token transfer of no monetary value to it, and plant that record in the user's displayed transaction history. They then initiate a transfer to the poisoned address and record whether the wallet filters the record, displays it, or issues a warning at the send step. The second load-bearing component is the wallet's dependency on a transaction-activity provider: an external service that assembles the list of token transfers shown to the user. The paper shows that filtering of phishing records i
What would settle it
Re-run the same simulation on the same 53 wallets with the fake transfer placed at the top of the history and with a nonzero ERC-20 amount. If any of the 16 wallets the paper labels high-risk then hides the record or shows a warning when the user attempts to send to the poisoned address, the central claim of widespread non-protection would be contradicted, because the original result would depend on the specific test setup rather than on the wallets' actual behavior.
Extended reading notes
Core claim
The central discovery is empirical: the overwhelming majority of Ethereum wallets do not protect users against address poisoning at the point of use. In the author's experiments, look-alike addresses were generated and a worth-less token transfer from each look-alike was placed into the transaction history shown by each wallet. Of the 53 wallets tested, 12 failed to retrieve transaction history at all due to provider communication problems. Among the wallets that did display history, 16 showed the phishing token transfer without any warning or visual distinction. Most critically, when the user attempted to send funds to one of the poisoned addresses, only 3 wallets issued an explicit warning
Load-bearing premise
The entire finding depends on the simulated address-poisoning attack faithfully reproducing how real phishing records appear in a live user's transaction history; if real attacks are placed, timed, or formatted differently, or if wallets behave differently when the history is fully synced, the measured absence of warnings may overstate the actual vulnerability.
Editorial extensions
If this is right
- Users cannot treat a wallet's transaction history as a true record of counterparties: the majority of tested wallets will display a fake token transfer without any flag, so even a careful user can be misled by the history itself.
- Because most wallets rely on an external transaction-activity provider, the protection of hundreds of apps can hinge on one backend's filtering quality; a single provider gap becomes a systemic vulnerability.
- The three wallets that do warn show that a practical, UI-level countermeasure is possible, so closing the gap is a matter of adoption rather than technical invention.
- The 12 wallets that failed to load transaction history leave users blind to their own record entirely, which is a separate usability failure that also removes the opportunity to notice a poisoned record.
Reading between the lines
- A natural next step is to turn this simulation into a continuous, public benchmark that is re-run on each new wallet release and provider update; without that, a one-shot audit could give users a false sense of ongoing protection.
- The provider-centric finding hints that a shared blacklist or a standard rule for filtering zero-value transfers from never-interacted addresses would lift protection across many wallets at once, independent of wallet UI design.
- The same experimental design likely applies to other smart-contract chains that use similar token standards, and the provider-dependency pattern suggests uneven protections will be found there as well.
- A concrete testable hypothesis from the paper's data is that the three warning wallets share a common provider that performs server-side checks; if true, the protection is a property of the backend, not the wallet front-end, and could vanish overnight if the provider changes policy.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper reports a systematic usability/security evaluation of 53 popular Ethereum wallets with respect to address-poisoning attacks. The authors simulate address-poisoning attacks, then measure whether wallets display fake token phishing transfers and whether they warn users before sending funds to a phishing address. The headline findings are: 12 wallets have communication failures with transaction activity providers; 16 wallets display fake token phishing transfers without apparent protection; and only 3 wallets show an explicit warning message when a user attempts to transfer to a phishing address. The paper interprets these findings as evidence that most Ethereum wallets do not adequately counter address poisoning, and notes that bug reports were acknowledged by developers.
Significance. If the findings hold, the paper would be a valuable, timely measurement of a real and costly phishing vector, providing concrete evidence about wallet-side defenses and highlighting a significant gap in the ecosystem. The paper is also commendable for reporting concrete counts and for engaging with developers via bug reports. However, the significance hinges on the validity and representativeness of the simulation and on the coding of protective behavior. At present, the abstract alone provides insufficient methodological detail to assess whether the measured warnings (or lack thereof) reflect address-poisoning-specific defenses or general wallet behavior.
major comments (3)
- [Abstract (Methodology)] The central result—16 wallets display fake token phishing transfers and only 3 explicitly warn—depends critically on the simulation design. The abstract does not report a control condition with unfamiliar, non-lookalike addresses, nor does it specify the degree of address similarity used. Without this baseline, it is impossible to determine whether the observed failures are specific to address poisoning or merely reflect a general absence of address-validation warnings in Ethereum wallets. This is a load-bearing concern: the same counts could arise if the simulated addresses are too dissimilar to trigger any similarity-based protection, or if the wallets never warn on any unfamiliar address.
- [Abstract (Operationalization of 'protection')] The claim that only 3 wallets 'throw an explicit warning message' equates protection with a single, narrowly defined behavior. The abstract does not state whether other protective mechanisms—such as transaction blocking, extra confirmation dialogs displaying the full address, or similarity-based alerts—were observed and coded. If those mechanisms exist but were not classified as 'explicit warnings,' the reported count understates wallet defenses. The manuscript should clarify the full coding scheme and justify why only explicit messages count as protection, or present protection as a multi-level outcome.
- [Abstract (Sample and generalizability)] The selection criteria for the 53 wallets are not described: how were they chosen, which versions/platforms (desktop, mobile, hardware, web) were included, and were they the latest versions at the time of testing? The finding that 12 wallets had communication failures with their transaction activity provider suggests that the sample and test environment may strongly influence the results. Without a clear sampling frame, the generalizability of the 'broader Ethereum crypto wallet community' conclusion is unclear.
minor comments (1)
- [Abstract (References)] The abstract cites 'recent works' for millions of users and $100M in losses but gives no citations; the full manuscript should include these references to support the motivation.
Circularity Check
No circularity: empirical measurement study with no derivation reducing to its inputs
full rationale
The paper is an empirical measurement study: it simulates address poisoning attacks and reports observed wallet behaviors, such as whether phishing transfers are displayed and whether explicit warnings are shown. There are no fitted parameters, no equations connecting inputs to outputs, and no load-bearing self-citations in the available abstract. The conclusion that 16 wallets display fake phishing transfers and only 3 warn is an empirical generalization from test observations, not a quantity forced by construction. Concerns about whether the simulation faithfully reproduces real-world address poisoning conditions, or whether 'explicit warning' is the only relevant protective behavior, are questions of experimental validity and not circularity: they do not make the reported results equivalent to the experimental inputs by definition. No self-definitional step, fitted-input-as-prediction, or author-imported uniqueness argument appears. Therefore the appropriate circularity score is 0.
Assumptions & free parameters
assumptions (3)
- domain assumption Address poisoning has caused over $100 million in losses to millions of Ethereum users, making it a significant threat.
- domain assumption The 53 selected wallets are representative of popular Ethereum crypto wallets.
- ad hoc to paper Simulated phishing transfers and lookalike addresses in the test environment trigger the same wallet behavior as real attacks.
Cite this review
Pith. "Pith review of Ethereum Crypto Wallets under Address Poisoning: How Usable and Secure Are They?." pith.science (2026). https://pith.science/paper/MCCSNRL2
@misc{pith2026250812107,
author = {Pith},
title = {Pith review of: Ethereum Crypto Wallets under Address Poisoning: How Usable and Secure Are They?},
year = {2026},
howpublished = {\url{https://pith.science/paper/MCCSNRL2}},
note = {Machine review of arXiv:2508.12107}
}
read the original abstract
Blockchain address poisoning is an emerging phishing attack that crafts "similar-looking" transfer records in the victim's transaction history, which aims to deceive victims and lure them into mistakenly transferring funds to the attacker. Recent works have shown that millions of Ethereum users were targeted and lost over 100 million US dollars. Ethereum crypto wallets, serving users in browsing transaction history and initiating transactions to transfer funds, play a central role in deploying countermeasures to mitigate the address poisoning attack. However, whether they have done so remains an open question. To fill the research void, in this paper, we design experiments to simulate address poisoning attacks and systematically evaluate the usability and security of 53 popular Ethereum crypto wallets. Our evaluation shows that there exist communication failures between 12 wallets and their transaction activity provider, which renders them unable to download the users' transaction history. Besides, our evaluation also shows that 16 wallets pose a high risk to their users due to displaying fake token phishing transfers. Moreover, our further analysis suggests that most wallets rely on transaction activity providers to filter out phishing transfers. However, their phishing detection capability varies. Finally, we found that only three wallets throw an explicit warning message when users attempt to transfer to the phishing address, implying a significant gap within the broader Ethereum crypto wallet community in protecting users from address poisoning attacks. Overall, our work shows that more efforts are needed by the Ethereum crypto wallet developer community to achieve the highest usability and security standard. Our bug reports have been acknowledged by the developer community, who are currently developing mitigation solutions.
Forward citations
Cited by 1 Pith paper
-
There Will Be Spam: Characterizing State-Invariant Transactions and Speculative MEV
State-invariant transactions are ~2.6% of Ethereum but 24–37% of Optimism/Base traffic; speculative MEV dominates L2 spam yet is often unprofitable after failed-attempt fees, and address poisoning is half of Ethereum’...
Reviewed August 5, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.