Project
Flash Token Protector: catching fake USDT
TL;DR "Flash USDT" scams send you a token that looks like USDT in your wallet but is worthless. I mapped 51 attack vectors to 9 defense layers and built a free, read-only checker for BSC, Ethereum and Tron.
The problem
Your wallet shows "USDT +1,000". The name, symbol, logo and even the price can all be faked. A scammer deploys their own token called USDT, sends it to you, and asks for real money or goods in return. Variants include forged transfer logs, transactions that mix real and fake tokens, payments that later revert, and "address poisoning", where tiny transfers from lookalike addresses trick you into copying the wrong address next time.
The rule that beats most of it
A token's identity is the chain plus its canonical contract address. Nothing else. The checker ignores name, symbol and price entirely. On BSC, canonical USDT is Binance-Peg BSC-USD (0x55d3…7955) with 18 decimals, versus 6 on Ethereum and Tron, which is a trap of its own.
What it checks
- Analyze a transaction, verify a claimed payment, or follow a wallet
- Check a token contract, or check an address before you send
- Flags fake tokens, forged logs, mixed real+fake transactions, reverted, pending or unfinalized transactions, zero-value and dust poisoning, lookalike addresses, risky approvals and unexpected EIP-7702 delegations
A result is only VERIFIED when two independent RPC providers agree and the block is finalized. It never says "safe". Every result comes with a risk dial, a plain verdict, explorer links and a map of who sent what to whom, including who created a fake token and who else received it.
The research behind it
The repo's docs/ATTACK_RESEARCH.md is a field guide to all 51 vectors. Each has the mechanism, a flow diagram, the detection rule and tests, a local-chain repro where one exists (Foundry/Anvil), and a cited real-world case. It is generated from the site's own data and checked in CI, so the docs can't drift from the code.
A note on hosting
The app moved from pages.dev to Firebase because MetaMask flags every free pages.dev subdomain. A security tool that triggers a security warning is a hard sell.