MetaMask / MetaMask/metamask-extension
[Bug]: Standard Base USDC approve(address,uint256) is displayed as an NFT withdrawal
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
### Describe the bug
MetaMask incorrectly displays a standard ERC-20 USDC approval as an NFT withdrawal.
Environment:
- Network: Base mainnet (`chainId: 8453`)
- MetaMask Extension: `13.46.1`
- Token: `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`
- Token standard: ERC-20
- Token decimals: 6
- Spender: `0x422fb47edDf129FC76EaE68B515609e23c6B9230`
- Function: `approve(address,uint256)`
- Selector: `0x095ea7b3`
- Raw approval amount: `251250000`
- Human-readable amount: `251.25 USDC`
MetaMask displays:
> Withdrawal request
> This site wants permission to withdraw your NFTs
> Withdraw #251250000 USDC
The displayed NFT identifier exactly matches the raw ERC-20 approval amount.
The approval target is the canonical Base USDC contract, not an ERC-721 or ERC-1155 contract. The issue is reproducible from both localhost and the deployed production website.
ERC-20 and ERC-721 share the same `approve(address,uint256)` ABI signature and selector. This may indicate that the confirmation decoder is interpreting the second argument as an ERC-721 `tokenId` without correctly resolving the target contract as ERC-20 USDC.
### Expected behavior
MetaMask should identify the target contract as ERC-20 USDC and display:
- Approval type: ERC-20 spending cap
- Token: USDC
- Spending cap: 251.25 USDC
The confirmation must not mention NFTs or display the raw ERC-20 amount as an NFT token ID.
### Screenshots/Recordings
### Steps to reproduce
1. Install or update MetaMask Extension to version 13.46.1.
2. Connect a standard EOA wallet to Base mainnet.
3. Ensure the wallet holds at least 250 USDC.
4. Ensure the current USDC allowance for the SEICHO spender is zero.
5. Open https://seichoframework.com/access?tier=advanced
6. Connect the wallet.
7. Select Sovereign, 1 Month and USDC.
8. Continue to the membership confirmation step.
9. Click the button that requests the USDC approval.
10. Inspect the MetaMask confirmation without confirming the transaction.
11. MetaMask displays the ERC-20 approval as an NFT withdrawal and shows `#251250000 USDC`.
The same behavior is reproducible from `https://seichoframework.com/access?tier=advanced`.
### Error messages or log output
```shell
No console or runtime error is produced.
The problem occurs in the MetaMask transaction confirmation UI before the transaction is signed or submitted.
Displayed wording:
Withdrawal request
This site wants permission to withdraw your NFTs
You're giving someone else permission to withdraw NFTs from your account.
Withdraw #251250000 USDC
```
### Where was this bug found?
Live version (from official store)
### Version
13.46.1
### Build type
None
### Browser
Brave
### Operating system
Windows
### Hardware wallet
_No response_
### Additional context
_No response_
### Severity
_No response_
Contributor guide
Research direction
Start by reproducing the approval on Base mainnet with the provided USDC contract, spender, selector, and amount, then trace the transaction confirmation decoder and token-standard resolution for approve(address,uint256). Done means the ERC-20 approval is identified as a spending cap and the confirmation no longer presents it as an NFT withdrawal.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- blockchain, frontend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100