MetaMask has shipped a new default-on safeguard aimed at one of the more unsettling phishing techniques to emerge alongside Ethereum's smart-account upgrades: contracts designed to look harmless during a wallet's pre-transaction simulation, then behave maliciously once the user actually signs. Version 13.45 of the browser extension introduces a feature called Added Protection, which simulates a transaction's outcome before the user confirms it in a DApp, then locks that simulated result in as a condition the real on-chain execution has to match. If the actual result diverges from the preview — say, a contract that appeared safe during simulation but attempts to transfer assets away once executed for real — the transaction automatically reverts, limiting the user's loss to the network's gas fee rather than the assets in their wallet.
The technique the feature targets is commonly called a "Red Pill" attack, named for a contract's ability to detect when it's being run inside a simulation environment and behave safely there, only to revert to its actual malicious logic once it detects a live, signed transaction. Because wallet simulations are a core layer of user protection — most wallets show users a preview of what a transaction will do before asking for a signature — an attacker who can reliably distinguish simulation from execution can defeat that entire safety check. Red Pill behavior has become more relevant since EIP-7702 introduced smart-account-style delegation to standard Ethereum wallets: earlier this year, a phishing group exploited 7702 delegation mechanics to drain over $146,000 from a single incident, part of more than $12 million pulled from over 15,000 wallets industry-wide through similar delegation-based attacks. Wallet security has been under strain from multiple angles this year, not just delegation exploits — a separate audit found 45 of 904 screened iOS crypto wallets failed basic security checks badly, and hackers separately demanded $3 million in Monero from Revolut while threatening to sell stolen customer data.
How the lock-in mechanism actually works
Rather than simply warning users about a risky-looking contract call — the approach most wallets have relied on — Added Protection treats the simulated outcome as a binding contract of its own. The wallet doesn't just show the user what it expects to happen; it enforces that expectation at the transaction level, so any gap between the preview and the real execution triggers an automatic revert rather than relying on the user to notice something looks wrong. That shifts the security model from detection-and-warning to enforcement, which matters specifically against Red Pill contracts designed to evade detection in the first place.
Related: DCENT Flags Abnormal Transfers, Urges App Wallet Users to Move Funds
The feature is enabled by default, though users can manually turn it off from the transaction confirmation screen if they choose. It currently covers the 13 EVM networks that support EIP-7702 smart accounts, with a mobile version planned for a later release. Because the feature specifically targets 7702-related delegation attacks, its rollout is a fairly direct response to the pattern of exploits that have accompanied smart-account adoption across the Ethereum ecosystem this year.
MetaMask remains the most widely used self-custody wallet in the Ethereum ecosystem, which means a default-on protection shipped to its user base has an outsized effect on the overall success rate of Red Pill-style attacks industry-wide — even a phishing campaign that successfully evades every other wallet's simulation layer gains nothing against users on a version of MetaMask with Added Protection enabled. Other wallet providers have historically followed MetaMask's lead on security defaults within months of a major feature shipping, so the industry-wide impact of this specific mechanism is likely to extend well beyond MetaMask's own user base over time. Users who fell for schemes like the recent fake GTA 6 "leak" site that was actually a multi-chain wallet drainer are exactly the kind of victim Added Protection is designed to catch before a signature turns into a loss.
FAQ
What is a Red Pill attack?
It's a phishing technique where a malicious contract detects when a wallet is simulating a transaction and behaves safely during that preview, then executes harmful logic — like draining assets — once the user actually signs and the transaction runs for real.
Is Added Protection turned on automatically?
Yes, MetaMask enabled the feature by default in v13.45, though users can switch it off manually from the transaction confirmation screen if they prefer.
Which networks does the feature cover?
It currently supports the 13 EVM networks that support EIP-7702 smart accounts; a version for MetaMask's mobile app is planned but not yet available.
