<p>In the fascinating Web3 world, it is becoming more and more common to be rewarded by projects just for being part of the space, for instance by using an NFT marketplace like OpenSea, or by making transactions on a decentralized exchange (DEX).</p><p>While these are being called airdrops, they don&#8217;t technically fit the description. Rather than tokens being transferred to eligible wallets, users have to interact with a smart contract, pay the gas fee, and collect their rewards.</p><p>The amount of tokens distributed would depend on different factors.</p><h2>Example: OpenDAO ($SOS) Airdrop&nbsp;</h2><p>Let&#8217;s take as an example the OpenDAO ($SOS) airdrop.</p><p>Users were rewarded based on their trading volume on OpenSea (the most popular NFT marketplace) and the total number of transactions. In order to collect their rewards, users were required to visit their official website, connect their ETH wallet, and press collect. This would interact with the smart contract and call the function <strong>claim</strong> which is shown below (available at <a href="https://etherscan.io/address/0x3b484b82567a09e2588A13D54D032153f0c0aEe0#code">Etherscan</a>):</p><p>​<img decoding="async" loading="lazy" class="wp-image-1638" style="width: 900px" src="https://halborn.com/wp-content/uploads/2022/03/claim.png" alt=""></p><p>​</p><p>As inviting as this all sounds (who does not like free magic internet money?), this trend opens the door for multiple scams, where users interact with a smart contract and sign a request they might not fully understand.</p><p>​</p><h2>Web3 Safety Concerns</h2><p>​In order to be secure in the Web3 world, and especially when interacting with a smart contract, the following points should be considered:</p><h3>Inspect the source code</h3><p>As tokens need to be claimed from a smart contract, it is vital to do due diligence and inspect the source code (or wait for some reputable source to inspect it for you), before interacting with it.</p><p>Look if the contract is verified &#8211; A contract&#8217;s code can only be inspected if it is verified. If verified, review the source code or wait for a reputable source to review it. Below is how a verified contract looks like on Etherscan.</p><p></p><figure class="wp-block-image size-large"><img decoding="async" loading="lazy" src="https://halborn.com/wp-content/uploads/2022/03/verified-1024x481.png" alt="" class="wp-image-1639" /></figure><h3>Check for suspicious functions</h3><p>mint function &#8211; Can the owner mint extra tokens for themselves?</p><p>freeze function &#8211; Can the owner freeze assets?</p><p>self destruct &#8211; Can the owner destruct the contract and take away all of the tokens?</p><h3>Check the liquidity in the liquidity pool</h3><p>Is there enough liquidity to trade the token? &#8211; <a href="https://www.theblockcrypto.com/post/130350/a-look-at-the-fees-wtf-airdrop-and-what-went-wrong">Low liquidity bot war&nbsp;</a></p><h3>Check Token Sniffer</h3><p>Check on <a href="https://tokensniffer.com/token/0x5b8dbbb415696996a3d674e656054ecf069eb736">TokenSniffer.com</a> if the contract is there or has similarities with other malicious contracts.</p><h3>Check the Token Supply</h3><p>Is most of the token supply in the hand of one address which is not the smart contract?</p><h3>Use a Throw-Away Wallet</h3><p>Finally, it is always recommended to use a throw-away wallet for interacting with unknown contracts. The throw-away wallet should only contain the required funds to pay for the gas fee and no other tokens.</p><p>​</p><h2><strong>You signed an unknown request on your Web3 wallet. Now what?</strong></h2><p>If you signed a request you should not have with your Web3 wallet on the Ethereum network, and you want to make sure that your tokens are safe, within Etherscan it is possible to view and revoke all approvals given for both ERC20 and ERC721 tokens.</p><p>Head over to <a href="https://etherscan.io/tokenapprovalchecker">Etherscan</a>, connect your Web3 wallet and revoke approvals for all the spenders you are unsure about or you do not need anymore. This <a href="https://support.opensea.io/hc/en-us/articles/4416083190291-How-can-I-revoke-token-approvals-and-permissions-on-Ethereum-#:~:text=Head%20to%20https%3A%2F%2Fetherscan,to%20revoke%20the%20token%20approval">guide</a> by OpenSea shows the whole process with videos.</p><p>Other EVM compatible chains would provide similar services, for instance:</p><ul><li>Polygon &#8211; <a href="https://polygonscan.com/tokenapprovalchecker">Polygonscan</a></li><li>Avalanche C-Chain &#8211; <a href="https://snowtrace.io/tokenapprovalchecker">Snowtrace</a></li><li>Fantom &#8211; <a href="https://ftmscan.com/tokenapprovalchecker">Ftmscan</a></li><li>Moonriver &#8211; <a href="https://moonriver.moonscan.io/tokenapprovalchecker">Moonscan</a></li></ul><p>​</p><h2><strong>Examples</strong></h2><p>In recent months, the following projects released their own tokens, and some of them have been more successful than others.</p><p></p><ul><li>$SOS &#8211; https://www.gasdao.org/</li><li>$YEAR &#8211; This project eventually &#8220;rugged&#8221; and their Twitter account was deleted. Holders who claimed the token only lost the GAS fee if they didn&#8217;t sell the tokens on time</li><li>$LOOKS &#8211; https://looksrare.org/</li><li>$GAS &#8211; https://www.gasdao.org/</li><li>$DAPPRadar &#8211; https://dappradar.com/</li></ul><p></p><p>​</p><h2><strong>Links for further reading:</strong></h2><ul><li>​<a href="https://cryptobriefing.com/ethereum-project-airdrops-scam-token-then-pulls-the-rug/">https://cryptobriefing.com/ethereum-project-airdrops-scam-token-then-pulls-the-rug/</a></li><li><a href="https://cryptobriefing.com/nft-traders-wanted-opensea-airdrop-then-opendao-launched-christmas/">https://cryptobriefing.com/nft-traders-wanted-opensea-airdrop-then-opendao-launched-christmas/</a></li><li><a href="https://blockcast.cc/news/how-to-identify-malicious-smart-contracts-watch-out-for-these-red-flags/">https://blockcast.cc/news/how-to-identify-malicious-smart-contracts-watch-out-for-these-red-flags/</a></li></ul><p>​</p><h2><strong>Disclaimer</strong></h2><p></p><p>This article should not be considered as an endorsement for any of the mentioned projects, as well as not being financial advice. Be safe in this crazy world.</p>

The New Claim Airdrop Trend Is It Safe (1)

The-New-Claim-Airdrop-Trend-Is-It-Safe-1.jpg

The new claim airdrop trend opens the door for multiple scams. Blockchain cybersecurity firm Halborn explains.

// Blog

Alessandro Cara

Articles