3rd Web Hack prototype

Flagged lookalikes need sender approval.

A verified payee gets paid instantly. An unknown address waits in a cancellable escrow. A lookalike matching a trusted payee enters a 24-hour lock and cannot claim without the sender approving that escrow on-chain.

Watch the recorded demo View source and setup Open slide deck

Local test environment: The video shows real contract interactions on Anvil with mock assets, including the sender approval gate and a claim after the 24-hour lock. This page is a showcase; transactions require running Anvil locally. SafeSend is unaudited and must not be used with real funds.

End-to-end walkthrough

In this two-minute captioned demo, a poisoned history entry triggers a lookalike warning and on-chain quarantine. The recipient cannot claim after the lock without sender approval. An approved claim then verifies that exact address for future instant sends.

Recorded on a fresh local Anvil chain with synthetic addresses and mock mUSDT. The earlier cancellation walkthrough shows a sender recovering escrowed funds; the current contract also permits cancellation after approval while the escrow is pending. No mainnet funds or paid keys were used.

One router, three send paths

01 · Verified

Instant delivery

Known payees receive funds directly. No escrow or waiting period.

02 · Unknown

Cancellable escrow

New recipients claim after the sender's cooldown. The sender can cancel while pending.

03 · Lookalike

Lock and approval

A first/last-four fingerprint collision raises an on-chain flag and a 24-hour lock. The recipient can claim only after the sender approves that escrow. A successful claim verifies the full address for future instant sends.

See the prototype in context

Screenshots from the current local Anvil walkthrough. The attack tool is educational and uses test assets only.

Local test attacker console preparing a lookalike address — Educational attacker console

Transaction history containing a poisoned address entry — Poisoned transaction history

Send screen warning that the pasted address resembles a verified payee — Lookalike warning before sending

Quarantined escrow showing the full recipient address and sender approval button — Sender reviews the full address

Recipient cannot claim the unlocked escrow without sender approval — Unlocked but still blocked

Sender approval recorded for the flagged escrow — Explicit sender approval

Verified payee list showing full addresses for the real payee and lookalike — The claimed address becomes verified

Send screen showing the newly verified recipient will be paid instantly — Future sends to it are instant

Run the real app locally

The contracts and interactive web UI are open source. You need Foundry and Node.js; the README has the complete setup.

git clone https://github.com/sharonbasovich/safesend.git
cd safesend
make anvil          # separate terminal
make deploy-local
make seed
make web            # http://localhost:5173/?demo=1