False positive security alert for EverDraw deposits on Monad

### What is this about?

MetaMask Security Alerts appears to be showing a false-positive malicious/review warning for EverDraw deposits on Monad mainnet.

This is actively blocking users from depositing into the current EverDraw vault even though the transaction is a direct payable call to the verified EverDraw contract.

### Details

- Dapp domain: https://everdraw.xyz
- Chain: Monad mainnet, chain id 143
- Destination contract: 0x1886f329e486e934c76028B15a580850e74d404C
- Contract name/symbol on-chain: EverDraw Position / EVRDRAW-B
- Method: buyTickets(uint32)
- Selector: 0x444132be
- Current intended transaction shape from production frontend: minimal eth_sendTransaction with only from, to, data, value
- Example successful user tx: 0x1c1ea287eb6069c887daebc4925588de90c3d818e8ff5ae8e8837d3db1cc15d3

### Verification evidence

- Dapp production URL is live: https://everdraw.xyz
- Contract is Sourcify verified with full creation/runtime match:
https://sourcify-api-monad.blockvision.org/v2/contract/143/0x1886f329e486e934c76028B15a580850e74d404C
- Sourcify response at time of filing:
{"matchId":"540669","creationMatch":"match","runtimeMatch":"match","verifiedAt":"2026-06-11T03:27:11Z","match":"match","chainId":"143","address":"0x1886f329e486e934c76028B15a580850e74d404C"}
- The transaction emits TicketsBought(uint256,address,uint32,uint256), whose event topic is:
0x7d84e7639eb0d0a1d1c0368e328c18126a5a841fcc1c89727c20ba79bcef19d8
- The successful example tx deposited 100 MON through buyTickets(100) and did not emit an ERC-20 Approval event.

### What we already changed on the frontend

Two frontend hotfixes were deployed to production on staging:

1. PR #140: prefer the injected EOA wallet provider for deposits and disable Web3Modal wallet features that can promote smart-wallet/delegation behavior.
2. PR #141: remove dapp-supplied nonce/gas/gasPrice from the final MON deposit transaction; MetaMask now receives the minimal transaction object and controls gas/nonce.

After both changes, the warning still appears for the operator, which suggests this is a MetaMask/Blockaid classification issue rather than a dapp transaction construction issue.

### Request

Please review and clear the false-positive classification for:

- https://everdraw.xyz
- 0x1886f329e486e934c76028B15a580850e74d404C on Monad mainnet

If there are multiple signals firing, please identify whether the remaining signal is domain-based, address-based, or calldata/simulation-based so we can provide any additional verification required.

No repository file or test is identified in the report. Start by tracing the MetaMask Security Alerts classification entry points for domain, contract address, and calldata or simulation signals, then compare the behavior with PRs #140 and #141 and the supplied transaction evidence. Done means the false-positive classification is cleared or the remaining signal and required verification are documented.

Written by the indexing model from the issue text.