Week in literacy
Five short literacy notes from primary wallet, protocol, and consumer-protection sources. Original paraphrases only—link out to read the originals. Educational content only — not investment advice.
1. Lookalike addresses still hitch a ride in your history
MetaMask’s Help Center explains address poisoning simply: an attacker sends a tiny transfer from a vanity address that matches the start and end of someone you already paid, hoping you copy the wrong row from history later. Wallet warnings for lookalikes and first-time recipients are a pause button—not a substitute for checking middle characters or using a contacts list you verified yourself.
Literacy takeaway: Treat transaction history as untrusted paste fodder; confirm the middle of the address or pick a saved contact. See our address-poisoning doc.
Source: Address poisoning scams — MetaMask Help Center (2026-09-14) — https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/
2. “Looks fine in preview” is not the same as on-chain
MetaMask documents that ordinary offchain simulations can be fooled when a contract behaves differently in a preview than in real execution (“red-pill” style attacks). Their “Added protection” path re-checks onchain and reverts if execution does not match the simulation—so what you confirmed is what runs, at the cost of extra network fees if you enable it.
Literacy takeaway: Read the balance-change preview, then decide whether enforced simulation is worth the extra gas for unfamiliar contracts. Pair with how to read a wallet prompt.
Source: What are transaction simulations? — MetaMask Help Center (2026-09-14) — https://support.metamask.io/manage-crypto/transactions/simulations/
3. Unlimited spend limits are a standing permission, not a one-time click
ethereum.org’s security guide still puts the same rule front and center: when a contract asks for token access, prefer a limit equal to what you need for that use—not an open-ended allowance that can keep spending later. Combined with “never share your recovery phrase,” it is the core self-custody hygiene newcomers skip under pressure.
Literacy takeaway: Approvals persist until you change them; seeds are never for “support.” See what is a token approval and seed-phrase safety.
Source: Ethereum security and scam prevention — ethereum.org (2026-06-06) — https://ethereum.org/en/security/
4. Disconnecting a site does not cancel an allowance
ethereum.org’s revoke guide separates two habits people confuse: leaving a dapp connection versus sending a transaction that sets a spender’s allowance back to zero. Old unlimited approvals can still move tokens years later; public checkers help you inventory them, but you still pay gas and must verify network and spender yourself.
Literacy takeaway: Disconnect ends a session; revoke clears on-chain permission. Walk through how to revoke a token approval.
Source: How to revoke smart contract access to your crypto funds — ethereum.org (2026-06-06) — https://ethereum.org/en/guides/how-to-revoke-token-access/
5. Anyone demanding crypto “to protect your money” is running a known FTC pattern
Why it matters this week: romance, investment, and government-impersonation scripts still push people to buy crypto and send it under urgency. The FTC’s consumer page is blunt—legitimate businesses and agencies do not demand advance cryptocurrency payment, and dating-plus-investment pitches are treated as scams by default. Transfers are usually irreversible, so reporting paths (FTC, IC3, and your exchange) matter after the fact.
Literacy takeaway: Urgency + “send crypto now” + impersonation = hang up and verify on official channels. Pattern library: common crypto scams.
Source: What To Know About Cryptocurrency and Scams — Federal Trade Commission (2022-05) — https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-scams
Educational content only — not investment advice. This digest paraphrases public educational pages for literacy. It does not recommend buying, selling, or holding any cryptocurrency or token, and it is not financial, tax, or legal advice.