MetaMask / MetaMask/metamask-extension

[Bug]: Standard Base USDC approve(address,uint256) is displayed as an NFT withdrawal

Open
#46,093 1 comment 0 reactions 0 assignees View on GitHub
cs-triaged external-contributor regression-prod-13.46.1 Sev3-low team-confirmations type-bug
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

### Describe the bug

MetaMask incorrectly displays a standard ERC-20 USDC approval as an NFT withdrawal.

Environment:

- Network: Base mainnet (`chainId: 8453`)
- MetaMask Extension: `13.46.1`
- Token: `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`
- Token standard: ERC-20
- Token decimals: 6
- Spender: `0x422fb47edDf129FC76EaE68B515609e23c6B9230`
- Function: `approve(address,uint256)`
- Selector: `0x095ea7b3`
- Raw approval amount: `251250000`
- Human-readable amount: `251.25 USDC`

MetaMask displays:

> Withdrawal request
> This site wants permission to withdraw your NFTs
> Withdraw #251250000 USDC

The displayed NFT identifier exactly matches the raw ERC-20 approval amount.

The approval target is the canonical Base USDC contract, not an ERC-721 or ERC-1155 contract. The issue is reproducible from both localhost and the deployed production website.

ERC-20 and ERC-721 share the same `approve(address,uint256)` ABI signature and selector. This may indicate that the confirmation decoder is interpreting the second argument as an ERC-721 `tokenId` without correctly resolving the target contract as ERC-20 USDC.

### Expected behavior

MetaMask should identify the target contract as ERC-20 USDC and display:

- Approval type: ERC-20 spending cap
- Token: USDC
- Spending cap: 251.25 USDC

The confirmation must not mention NFTs or display the raw ERC-20 amount as an NFT token ID.

### Screenshots/Recordings

Image
Image

### Steps to reproduce

1. Install or update MetaMask Extension to version 13.46.1.
2. Connect a standard EOA wallet to Base mainnet.
3. Ensure the wallet holds at least 250 USDC.
4. Ensure the current USDC allowance for the SEICHO spender is zero.
5. Open https://seichoframework.com/access?tier=advanced
6. Connect the wallet.
7. Select Sovereign, 1 Month and USDC.
8. Continue to the membership confirmation step.
9. Click the button that requests the USDC approval.
10. Inspect the MetaMask confirmation without confirming the transaction.
11. MetaMask displays the ERC-20 approval as an NFT withdrawal and shows `#251250000 USDC`.

The same behavior is reproducible from `https://seichoframework.com/access?tier=advanced`.

### Error messages or log output

```shell
No console or runtime error is produced.

The problem occurs in the MetaMask transaction confirmation UI before the transaction is signed or submitted.

Displayed wording:

Withdrawal request
This site wants permission to withdraw your NFTs
You're giving someone else permission to withdraw NFTs from your account.
Withdraw #251250000 USDC
```

### Where was this bug found?

Live version (from official store)

### Version

13.46.1

### Build type

None

### Browser

Brave

### Operating system

Windows

### Hardware wallet

_No response_

### Additional context

_No response_

### Severity

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the approval on Base mainnet with the provided USDC contract, spender, selector, and amount, then trace the transaction confirmation decoder and token-standard resolution for approve(address,uint256). Done means the ERC-20 approval is identified as a spending cap and the confirmation no longer presents it as an NFT withdrawal.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
blockchain, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.