Approvals to contracts unknown to Blockaid blanket appear as "Deceptive Request"

What is this about?

I'm with https://drips.network, and we're about to launch a campaign with Web3Privacy Now for donations to a bunch of privacy-focussed projects. We just noticed that MetaMask displays a very intense warning when making a donation during the ERC-20 approval transaction:

Our approvals are only for the necessary amount, and our contract is definitely not deceptive or "known for scams".

It looks as if this warning appears on an approval request to every contract that is unknown / unclassified on Blockaid.

I already submitted a "false positive" report to Blockaid directly, however I think that this warning should not confidently state "This is a deceptive request" unless Blockaid has explicit reason to classify it as such, which does not appear to be the case here. The wording is too strong for the case when Blockaid simply hasn't explicitly marked the recipient contract as "trusted".

Scenario

No response

Design

No response

Technical Details

No response

Threat Modeling Framework

No response

Acceptance Criteria

No response

Stakeholder review needed before the work gets merged

• Engineering (needed in most cases)
• Design
• Product
• QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
• Security
• Legal
• Marketing
• Management (please specify)
• Other (please specify)

References

No response

The issue provides no file, test, or entry point. Start by reproducing the ERC-20 approval donation flow in the MetaMask extension and inspect how Blockaid's classification becomes the displayed warning. Done means unknown or unclassified contracts no longer receive the confident "Deceptive Request" wording without an explicit deceptive classification.