Spam NFTs and Scam Tokens: How Rabby’s Filtering Features Keep Your Wallet Clean

24 Sep Spam NFTs and Scam Tokens: How Rabby’s Filtering Features Keep Your Wallet Clean

An Ethereum user wakes to find their wallet cluttered with worthless NFTs: pixelated images of apes that were never purchased, strange token contracts that appeared overnight, and garbled text claiming free airdrops. The wallet address is public on the blockchain; anyone can send anything to it. The attacker does not need permission, approval, or the user’s consent. They only need the address and a small amount of gas to transfer a contract address pointing to a token or NFT collection into the user’s holdings. What appears as clutter is often the first stage of a more serious attack: establishing false legitimacy before the phishing message arrives, or obscuring a real asset among dozens of fakes to prevent the user from finding it.

The problem is not new, but it has become more efficient. A malicious token contract can be deployed for pennies, then airdropped to thousands of addresses at once. Scammers can mint NFTs faster than they can be blocked. The visual noise serves a purpose: it trains users to ignore warnings, makes wallets harder to navigate, and creates confusion about what assets they actually own. A wallet that treats all tokens and NFTs equally will display the spam alongside legitimate holdings, forcing the user to distinguish real from fake through trial and error.

How NFT dusting and token airdrops become attack infrastructure

An NFT dust attack works by sending unsolicited NFTs to wallet addresses. The attacker deploys a collection, mints tokens, and broadcasts them to thousands of addresses harvested from public blockchain data. A single transaction can transfer NFTs to many addresses at once, keeping the cost low. Once the NFT appears in the victim’s wallet, the attacker’s collection has gained visibility and a holder count that may impress or mislead other users. More importantly, the NFT itself can be weaponized: clicking on it might redirect to a phishing site, opening metadata might trigger a script, or simply displaying it in a wallet interface might make the user curious enough to interact with a malicious contract.

Token airdrops operate on similar principles but often with additional social engineering. A scammer creates a token contract with a familiar name—a fake version of a legitimate project—then “gifts” tokens to addresses copied from successful projects or public leaderboards. When the user sees the token appear in their wallet, the natural instinct is to check if it has value. Visiting the contract address, the Dapp site, or clicking a link in the token’s metadata can lead to a fake swap interface designed to steal approval permissions or private keys. The token itself may be worthless, but its primary function is to attract the user’s attention and create enough plausibility to bypass initial skepticism.

The psychological mechanism matters because it is not purely technical. A cluttered wallet reduces cognitive clarity: the user becomes less certain about which assets are real, which warnings matter, and whether they are looking at something they actually own. Legitimate wallet functions become harder to use. If a user with one hundred tokens and fifty NFTs is trying to find a specific token to send, they must scroll, search, or sort to locate it. A wallet that displays everything equally makes that task tedious enough that the user might skip verification steps or give up. The spam is not just visual noise; it is a form of usability sabotage.

Because Ethereum and EVM-compatible networks allow anyone to send any token or NFT to any address without permission, the technical barrier to attack is nearly zero. The defense therefore cannot be purely technical in the sense of preventing the transfer itself. Instead, the wallet must be designed to help users immediately distinguish legitimate holdings from junk, and to highlight when an asset or interaction carries genuine risk.

Rabby’s spam and scam detection systems

Rabby Wallet addresses spam through multiple filtering layers rather than relying on a single blocklist. The first layer is token verification: the wallet maintains a database of known tokens, sourced from on-chain data providers, community submissions, and historical transaction records. When a token appears in a user’s holdings, Rabby checks it against this database. If the token is not recognized, the wallet can display a warning or hide it by default, depending on the user’s preferences. This is not foolproof—new legitimate tokens will not be verified immediately—but it immediately separates assets that have community recognition from newly deployed contracts that have no transaction history.

The second layer is risk flagging. Rabby analyzes token contracts for characteristics associated with scams: functions that allow the deployer to mint tokens indefinitely, contracts that can pause transfers, hidden taxes or fee structures, or contracts that demonstrate copy-pasted code from known malicious projects. If a token shows these patterns, the wallet displays a warning even if the user chooses to display unverified tokens. The warning does not prevent the user from interacting with the token—Rabby is a non-custodial wallet and cannot freeze assets—but it makes the risk visible before the user makes a decision.

For NFTs, the logic is similar but adapted to the different structure of NFT contracts. Instead of analyzing token mechanics, Rabby checks NFT collections against known marketplaces, historical trading data, and verified creator addresses. Collections that appear in spam campaigns, have zero trading history, or show signs of impersonation are flagged or hidden. NFTs from verified collections—those created by known artists, trading on major platforms, or with established resale activity—display normally. Users can adjust their filtering preferences: some may want to see all assets including unverified ones, while others prefer a clean view that shows only recognized tokens and NFTs.

The distinction between hiding and warning is important. Hiding an asset by default is more aggressive and makes the wallet cleaner, but it risks obscuring a new but legitimate asset. Warning about an asset lets the user remain in control: they see the risk flag and choose whether to investigate further or ignore it. Rabby’s approach emphasizes the warning rather than hiding, giving users visibility while encouraging caution.

Transaction simulation and approval transparency

Spam and scams do not stop at passive assets appearing in a wallet. The real danger emerges when a user interacts with a malicious contract, approves a token, or signs a transaction that appears legitimate but executes something harmful. This is where transaction simulation becomes critical. When a user initiates a transaction through Rabby—whether a swap, approval, or contract interaction—the wallet does not immediately ask for a signature. Instead, it simulates the transaction against the current blockchain state to show what will actually happen.

If a user attempts to swap what they believe to be legitimate token A for token B, but the contract is designed to silently extract their entire wallet balance, the simulation will show that result. If a token approval is unlimited, the simulation will indicate what the smart contract can do. If a transaction is reverting due to insufficient liquidity or a failed condition, the simulation will catch it before the user wastes gas. This is particularly valuable because many scams rely on the user not seeing what they are actually approving. A fake token contract might claim to send funds to an address but actually redirect them. A swap interface might show one rate but execute another. Simulation makes these deceptions harder to hide.

Rabby displays the simulated outcome in clear language alongside the original transaction parameters. The user can see “You will send 1.0 ETH and receive approximately 25,000 tokens” or “You are approving contract 0x1234… to spend unlimited USDC.” This transparency is paired with token approval review, which shows the user a history of contracts they have previously approved and allows them to revoke those approvals without waiting for a fresh transaction from the contract itself. If a user realizes they approved a token to an unknown address, they can remove that permission immediately.

Cross-chain spam management and network-specific filtering

Rabby supports multiple EVM chains including Arbitrum, Optimism, Base, Polygon, and BNB Smart Chain. Spam and scams proliferate across all of them, and attackers often deploy the same malicious token contracts on every chain to maximize reach. A user managing assets across six networks might accumulate spam on each one, compounding the clutter problem. Rabby’s approach is to apply consistent filtering rules across all supported chains while respecting the different token verification databases for each network.

A token that is recognized on Ethereum mainnet may be new on Polygon, so Rabby maintains separate verification status for each chain. However, risk analysis patterns are universal: a contract that appears designed to extract unlimited approvals is dangerous on any chain. Similarly, spam campaigns often target many chains at once, so Rabby’s database of known scam patterns includes cross-chain signatures. If a contract is identified as malicious on one chain, that information is available to flag similar contracts on others.

Users can also customize filtering per network if they are engaging with emerging DeFi protocols that are not yet verified. For example, a user testing a new Optimism project might temporarily set their filter to show all tokens so they can see the test token appear. Once testing is complete, they can return to the stricter setting. This flexibility is important because a wallet that is too aggressive about hiding assets becomes useless; a wallet that is too lenient becomes overwhelming. The balance depends on the user’s sophistication and risk tolerance.

How to use Rabby’s features to maintain a clean wallet

The first operational step is to understand the filtering preferences. When opening Rabby for the first time, users should navigate to settings and review the spam detection options. The wallet typically defaults to hiding unverified tokens and flagging suspicious contracts, but that default may not suit everyone. A user who expects to interact with new projects should understand that unverified does not mean unsafe—it simply means not yet verified by the community or Rabby’s data sources. Similarly, a flag does not prevent interaction; it is a signal to inspect further.

The second step is to use transaction simulation before approving anything. This is not a one-time setup; it should be part of every transaction. When interacting with a DeFi protocol, swap, NFT marketplace, or any contract for the first time, spend an extra moment reviewing the simulation. Read the sender, receiver, amount, and any approvals being granted. If something is unexpected, do not sign. Most scams work because the user either does not read the details or feels pressured to move quickly. Taking thirty seconds to verify a transaction—even on a familiar protocol—costs nothing in real terms.

Third, maintain awareness of token approval scope. Unlimited approvals are common in DeFi because they reduce transaction costs: the user approves once, and the contract can then execute multiple interactions without requiring repeated approvals. However, unlimited approval also means that if the contract is compromised, the attacker can drain the approved token instantly. Rabby’s approval review feature makes it easy to see what you have approved and to revoke approvals you no longer need. Before interacting with a new protocol, ask whether you actually need unlimited approval or whether you can limit it to a specific amount. This is a user decision, not something the wallet enforces, but tools like rabby wallet official make that decision transparent rather than hidden.

Fourth, be skeptical of NFT collections that appear in your wallet unsolicited. Most legitimate NFT projects announce drops and do not force NFTs on users. If an NFT appears without your action, check its collection status: Does it have trading history on a known marketplace? Are the metadata and images professional or obviously placeholder-quality? Does the collection address match what a legitimate creator would use? Clicking on an unknown NFT’s metadata or visiting its associated website is one of the most common entry points for phishing attacks. If you are uncertain, the safe action is to not interact with it.

Limitations and what filtering cannot prevent

Rabby’s filtering and simulation systems are powerful, but they have boundaries. Transaction simulation shows what will happen if a transaction succeeds, but it assumes the smart contract code is accurate. If a contract is designed to exploit a subtle vulnerability in the protocol or another contract, that vulnerability may not show up in the simulation. More commonly, simulation can show that a transaction is sending funds to the wrong address, but only if the user is paying attention to which address the simulation displays. User error remains the dominant attack vector: a phishing message that tricks the user into pasting someone else’s address, or a compromised browser extension that modifies what the user sees before they sign, can defeat any wallet’s protections.

NFT filtering is based on databases and historical data. A newly deployed NFT collection that is not yet known to Rabby’s sources will not be automatically flagged as spam, even if it is. The wallet can help the user understand that the NFT is unverified, but it cannot definitively determine intent. Similarly, a scammer can create a token with legitimate-looking code and no obvious red flags; the token contract itself might be safely written, but the associated website or Discord might be fraudulent. The technical analysis is one layer of defense, but it is not complete.

Rabby cannot protect against private key theft, phishing that occurs outside the wallet, or social engineering that convinces the user to send funds voluntarily. It also cannot prevent a user from deliberately interacting with a risky contract if they choose to ignore warnings. The wallet is designed to make the right choices easier and the wrong ones more visible, but it operates within the fundamental constraint that a non-custodial wallet must ultimately respect the user’s decisions.

Best practices for holding assets across multiple EVM chains

As users accumulate holdings on Arbitrum, Optimism, Base, Polygon, and BNB Smart Chain, the attack surface grows. Each chain has its own spam ecosystem and risk patterns. A comprehensive approach involves treating each chain with the same caution even if one chain feels “safer” than another. Do not assume that because Ethereum mainnet is well-established, assets on newer chains are necessarily less risky. Conversely, do not assume that a project on a newer chain is automatically a scam just because it is newer. Evaluate each interaction on its individual merits.

Maintain separate awareness of which addresses and contracts you have approved on each chain. An approval on Polygon is not active on Arbitrum, but if you have interacted with the same protocol on multiple chains, you may have approved multiple copies of the same contract address. Rabby’s approval review shows approvals by chain, making it possible to manage them independently. Periodically review these approvals and revoke any you no longer use.

Finally, assume that you will receive spam and that not all spam will be immediately recognizable. The presence of a token or NFT in your wallet does not mean you should interact with it or sell it. The presence of an unverified label does not mean the asset is definitely malicious. The presence of a warning means you should pause and investigate. By treating your wallet as an active defense problem rather than a passive storage box, and by using Rabby’s security features as assistants rather than guarantees, you reduce the likelihood that spam or scams will manipulate your decisions.