MetaMask / MetaMask/eth-phishing-detect

Blocklist removal request: easytokencreator.com

Open
#294,676 1 comment 0 reactions 0 assignees View on GitHub
needs more information
Dominant language
TypeScript
Stars
1.3k
Forks
1.1k
Avg merge
1m
Merged PRs (30d)
878

Description

### Legitimate domains, IPs, IPFS hashes, or IPNS names

https://easytokencreator.com/

### Please explain why this content is legitimate

EasyTokenCreator is a legitimate no-code token creation platform for deploying user-configured token smart contracts on supported EVM networks.

MetaMask currently displays a phishing/wallet-draining warning when users attempt to connect to https://easytokencreator.com/. The warning occurs during wallet connection, before any transaction or signature is requested.

We performed a comprehensive security review of the application and smart contracts. The wallet connection flow only requests account access. The application does not request personal_sign, eth_signTypedData, Permit/Permit2, token approvals, unlimited allowances, transferFrom, or setApprovalForAll from the connected wallet.

No transaction is automatically initiated after wallet connection. A transaction is created only after the user explicitly configures a token and clicks “Deploy Token”. The deployment fee shown in the UI matches the native-currency value of that transaction, and the fee recipient is transparently displayed before deployment.

We have also reviewed the smart-contract templates and production application, added additional transaction/fee transparency to the UI, and added security hardening including a Content Security Policy.

We believe the current classification is a false positive and respectfully request a manual review and removal of easytokencreator.com from the blocklist.

We can provide source-code references, smart-contract source, deployment-flow documentation, screenshots, and additional technical evidence if required.

Image

### Is this a duplicate request?

- [x] I have checked the issues page and confirmed this is not a duplicate request

Contributor guide

Open the contributing guide

Research direction

Start by reviewing easytokencreator.com and the repository's blocklist entry or detection data, then examine the reported wallet-connection flow and smart-contract templates. Done means completing the manual review and determining whether the domain should be removed from the phishing blocklist, with the decision supported by the requested security evidence.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.