Address poisoning keeps working because wallets show the first and last few characters of an address, and that's what people check. The attacker matches those ends, drops a dust transfer into your history, and waits for a copy-paste.
Global MPC built address-guard to check a destination before sending:
- Trusted recipients come only from your own outgoing transfers: successful, non-zero, signed by you, with the recipient named in your calldata. A poisoned inbound transfer can't make an address trusted.
- A destination that shares the first and last 4 hex characters with a trusted recipient but differs in the middle is flagged as a look-alike.
- EIP-55 checksum check.
- CLI exit codes (0 trusted, 10 new, 20 look-alike, 30 invalid) so a payout CSV can gate a CI job.
What it doesn't do: a brand-new malicious address is "new", not flagged. Payments via multisend or Safe don't build trust. ERC-20 on EVM only.
Repo: https://github.com/globalmpc/rwa-kit-js (MIT)
npm: @globalmpc/address-guard
Curious how others handle this in payout pipelines. Allowlists? Manual review? Something else?
