MetaMask / MetaMask/eth-phishing-detect
Blocklist removal request: easytokencreator.com
- Dominant language
- TypeScript
- Stars
- 1.3k
- Forks
- 1.1k
- Avg merge
- 1m
- Merged PRs (30d)
- 878
Description
### Legitimate domains, IPs, IPFS hashes, or IPNS names
https://easytokencreator.com/
### Please explain why this content is legitimate
EasyTokenCreator is a legitimate no-code token creation platform for deploying user-configured token smart contracts on supported EVM networks.
MetaMask currently displays a phishing/wallet-draining warning when users attempt to connect to https://easytokencreator.com/. The warning occurs during wallet connection, before any transaction or signature is requested.
We performed a comprehensive security review of the application and smart contracts. The wallet connection flow only requests account access. The application does not request personal_sign, eth_signTypedData, Permit/Permit2, token approvals, unlimited allowances, transferFrom, or setApprovalForAll from the connected wallet.
No transaction is automatically initiated after wallet connection. A transaction is created only after the user explicitly configures a token and clicks “Deploy Token”. The deployment fee shown in the UI matches the native-currency value of that transaction, and the fee recipient is transparently displayed before deployment.
We have also reviewed the smart-contract templates and production application, added additional transaction/fee transparency to the UI, and added security hardening including a Content Security Policy.
We believe the current classification is a false positive and respectfully request a manual review and removal of easytokencreator.com from the blocklist.
We can provide source-code references, smart-contract source, deployment-flow documentation, screenshots, and additional technical evidence if required.
### Is this a duplicate request?
- [x] I have checked the issues page and confirmed this is not a duplicate request
Contributor guide
Research direction
Start by reviewing easytokencreator.com and the repository's blocklist entry or detection data, then examine the reported wallet-connection flow and smart-contract templates. Done means completing the manual review and determining whether the domain should be removed from the phishing blocklist, with the decision supported by the requested security evidence.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100