Valid payloads for each pattern worth recognising. Click one to open it in the decoder. Nothing here touches a wallet or a chain — it is all decoded in your browser.
The payload behind a large share of drained wallets. Permanent, uncapped permission to spend one token.
Decode this0x095ea7b3000000000000000000000000…The same function, done safely — the spender can never take more than this amount.
Decode this0x095ea7b3000000000000000000000000…An approval of zero. This is what taking permission back looks like — a good transaction, not a threat.
Decode this0x095ea7b3000000000000000000000000…Grants one address control of every NFT you own in a collection, including ones you buy later.
Decode this0xa22cb465000000000000000000000000…The identical function with false instead of true. Byte for byte it looks almost the same — and does the opposite.
Decode this0xa22cb465000000000000000000000000…Adds to an existing allowance rather than replacing it, so a huge grant never shows the familiar all-Fs number.
Decode this0x39509351000000000000000000000000…Nothing alarming. Most of what you sign should look like this.
Decode this0xa9059cbb000000000000000000000000…Moves administrative control of a contract to another address.
Decode this0xf2fde38b000000000000000000000000…Irreversible. Every owner-only function becomes uncallable forever.
Decode this0x715018a6…Replaces a contract’s entire behaviour while keeping its address and its funds.
Decode this0x3659cfe6000000000000000000000000…What an honest answer looks like when the selector is unknown — it says so rather than guessing.
Decode this0xdeadbeef000000000000000000000000…Permits arrive as structured data rather than calldata, which is why they slip past people. Copy this and paste it into the decoder.
{
"primaryType": "Permit",
"domain": {
"name": "USD Coin",
"version": "2",
"chainId": 8453
},
"message": {
"owner": "0x3392Fd42E1a7355D96C8F3D2FDcf320abD0C8887",
"spender": "0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D",
"value": "115792089237316195423570985008687907853269984665640564039457584007913129639935",
"nonce": 0,
"deadline": "4102444800"
}
}
Any block explorer shows a transaction's raw payload. On Etherscan or Basescan, open a transaction, expand Input Data, and copy the hex.