NFT Approval Blast Radius Simulator (2D)

Wallet

NFTs held 12

Spender (operator)

Approval scope

No active approval

Live Readouts

Approved tokens

0 / 12

Blast radius

Exposure risk score

0 / 100

How it works

ERC-721 (NFT) contracts expose two independent approval mechanisms that let a third-party operator transfer tokens on your behalf — this is how marketplaces list and sell items without holding custody:

approve(operator, tokenId)       // scoped to ONE token
setApprovalForAll(operator, true) // scoped to EVERY token,
                                   // current AND future, of the collection

A phishing "mint", "claim your airdrop" or "list for free" page needs only one wallet signature to call setApprovalForAll in your name. Because the resulting isApprovedForAll[owner][operator] mapping is boolean and collection-wide, that single signature is enough for the operator contract to call transferFrom on every token you hold — the "blast radius" of one bad signature is the whole wallet, not just the item you thought you were interacting with.

This simulator models that exposure:

Spender — choose a trusted marketplace operator (green) or an unverified/phishing dApp (red).
Approval scope — approve() touches exactly one token; setApprovalForAll() touches the entire wallet.
Sign Approval Tx — commits the approval; approved tokens turn red and the translucent ring expands to the blast radius.
Revoke All Approvals — the real-world defensive action (e.g. via Etherscan's Token Approval Checker or revoke.cash): sets the operator mapping back to false and closes the exposure instantly.

Risk score model: risk = blastRadius% × trustFactor, where an unverified operator carries trustFactor = 1.0 and a known marketplace contract carries a discounted trustFactor = 0.15 (reduced but never zero — even audited contracts can be upgraded or compromised).

Drag the canvas to pan and scroll/pinch to zoom.

Unapproved token Approved — marketplace Approved — unknown dApp

drag to pan · scroll to zoom