Transaction Simulation

What Is Transaction Simulation?

Transaction simulation is a security feature that previews the outcome of a blockchain transaction before the user signs it. Instead of blindly approving a raw hexadecimal payload, users see a human-readable summary of what the transaction will actually do: which tokens will leave their wallet, which tokens they will receive, what token approvals will be granted, and which smart contracts will be called.

The simulation works by creating a local fork of the target blockchain, copying the latest on-chain state (account balances, contract storage, nonce values), and executing the unsigned transaction in this sandboxed copy. The engine captures the full execution trace: logs, state changes, token transfers, approval modifications, gas consumption, and any reverts. Results are then decoded from raw EVM output into plain-language summaries. The entire process happens off-chain in under 300 milliseconds, and nothing is broadcast to the network.

Transaction simulation emerged as a distinct product category in 2022, when five startups (Blowfish, Blockaid, Pocket Universe, Fire, and WalletGuard) launched dedicated simulation tools. By 2025, industry consolidation had reshaped the landscape: Phantom acquired Blowfish, ConsenSys acquired WalletGuard for MetaMask, Kerberus acquired both Pocket Universe and Fire, and Blockaid remained the dominant independent provider with $83 million in funding and integrations across 90% of major wallets.

How It Works

When a user initiates a transaction through a dApp or wallet, the simulation engine intercepts it before the signing device is invoked. The process follows a consistent pattern across providers:

1. The wallet captures the unsigned transaction parameters: target address, calldata, value, and gas limit
2. The simulation engine forks the current blockchain state, creating a sandboxed copy of all relevant account balances, contract storage slots, and nonce values
3. The transaction is executed against this forked state, producing a full execution trace including opcode-level detail, internal calls, and storage mutations
4. The engine decodes the raw output into human-readable results: expected balance changes, approval modifications, and contract interactions
5. A threat validation layer checks the results against known malicious addresses, flagged contracts, and suspicious patterns
6. The wallet presents the decoded results to the user, who can then approve or reject the transaction

Simulation vs. Static Analysis

Transaction simulation is sometimes confused with smart contract auditing and static analysis, but they serve fundamentally different purposes. Static analysis tools like Slither and Mythril examine contract source code or bytecode without executing it, searching for known vulnerability patterns such as reentrancy or integer overflow. This happens at the code level, typically before deployment.

Simulation, by contrast, evaluates a specific transaction against live blockchain state. This distinction matters because DeFi protocols involve chains of cross-contract interactions (flash loans, liquidity pool operations, oracle reads) that behave entirely differently under different input conditions. Static analysis reveals what could theoretically happen based on code patterns. Simulation reveals what will actually happen given the current state of every contract in the call chain.

What Users See

A well-designed simulation preview translates complex contract interactions into actionable summaries. For example, a Uniswap swap might display:

Expected outcome:
  - Send:    1.0 ETH
  - Receive: 3,200.00 USDC
  - Gas:     ~0.003 ETH

Approvals: None modified
Contract:  Uniswap V3 Router (verified)

By contrast, a malicious transaction disguised as a token claim might produce:

⚠ WARNING: Suspicious transaction

Expected outcome:
  - Send:    ALL USDC (12,450.00 USDC)
  - Receive: Nothing
  - Grants:  Unlimited approval to unverified contract

Risk:  CRITICAL — likely wallet drainer
Contract: Unverified (deployed 2 hours ago)

Major Providers and Wallet Integrations

Blockaid

Blockaid is the largest independent transaction security provider, founded in 2022 by former Israeli cyber intelligence personnel. With $83 million in funding (including a $50 million Series B in February 2025), Blockaid powers simulation for MetaMask, Coinbase Wallet, Rainbow, Safe, Uniswap, OKX, Ledger, and dozens of other wallets and dApps. Its architecture combines two components: transaction simulation (revealing full on-chain impact) and transaction validation (checking against threat heuristics and known malicious addresses). As of 2026, Blockaid reports scanning 2.4 billion transactions and blocking 71 million attack attempts, preventing over $5.3 billion in potential losses.

Wallet-Native Simulation

MetaMask integrated Blockaid through its Privacy Preserving Offline Module (PPOM), an offline security engine that simulates and validates transactions locally on the user's device. PPOM communicates only with the user's configured RPC node: no transaction data is shared with Blockaid or other third parties. This was enabled by default for all users in February 2024, covering Ethereum, Linea, BNB Chain, Polygon, Arbitrum, Optimism, Avalanche, Base, and later Solana (May 2025) and Bitcoin (December 2025).

Rabby Wallet, built by the DeBank team, takes a different approach: its simulation engine is built entirely in-house with no third-party provider. Simulation has been a core feature since Rabby's launch, supporting Ethereum and over 100 EVM-compatible networks. Before approving any transaction, users see expected balance changes, approval warnings, unlimited allowance risk flags, and contract risk assessments.

Phantom wallet acquired Blowfish in November 2024, bringing the simulation technology fully in-house. By that point, Phantom's simulation had already scanned over 85 million transactions and prevented more than 18,000 wallet-draining transactions across Ethereum, Solana, Polygon, Bitcoin, and Base.

Use Cases

Phishing and Wallet Drainer Detection

The primary use case for transaction simulation is catching phishing attacks and wallet drainers. Drainer kits, which are sold as turnkey services on dark web forums, create fake dApp interfaces that prompt users to sign transactions disguised as token claims, NFT mints, or airdrop redemptions. Without simulation, these transactions appear as opaque signing requests. With simulation, the actual token drain is immediately visible.

In the Ledger Connect Kit supply chain attack of December 2023, an attacker injected a wallet-draining payload into the @ledgerhq/connect-kit NPM package, compromising nearly 100 frontend dApps. Blockaid detected the attack within minutes and automatically blocked all related transactions for protected users. MetaMask users with Blockaid alerts enabled were 100% protected, while unprotected users lost between $484,000 and $600,000.

Malicious Approval Prevention

Many attacks rely on tricking users into granting unlimited token approvals to attacker-controlled contracts. Once an approval is granted, the attacker can drain the approved tokens at any time in the future, even days or weeks later. Simulation decodes ERC-20 approve() and setApprovalForAll() calls, showing users in plain language exactly what spending rights they are granting and to which contract.

Address Poisoning Defense

Address poisoning attacks plant lookalike addresses in a victim's transaction history, hoping the user will copy the wrong address for a future transfer. Simulation and address-checking mechanisms compare destination addresses against transaction history and flag suspicious near-matches. In December 2025, a trader lost $50 million in USDT after copying a poisoned address from transaction history, just minutes after a successful test transaction: exactly the kind of loss simulation warnings are designed to prevent.

DeFi Transaction Preview

Beyond security, simulation helps users understand complex DeFi interactions. Multi-step operations involving flash loans, liquidity pool deposits, or governance votes produce intricate chains of contract calls. Simulation breaks these into comprehensible summaries: tokens in, tokens out, fees incurred, and positions opened or closed.

Risks and Limitations

Time-of-Check vs. Time-of-Use (TOCTOU) Attacks

The most fundamental limitation of simulation is the time gap between previewing and executing. The simulation evaluates a transaction against a state snapshot, but the actual transaction executes later, potentially in a different state. Attackers exploit this gap by modifying on-chain contract state after the user sees a benign simulation but before the signed transaction confirms.

In January 2025, an attacker used this technique to steal 143.45 ETH (approximately $460,000). The victim visited a phishing site with a "Claim" function. The wallet simulation showed the user would receive a small ETH amount. Within roughly 30 seconds (between simulation and execution), the attacker modified the on-chain contract state, and the signed transaction drained funds instead.

On Solana, the "Vanish Drainer" used a similar approach: deploying programs that appeared benign during simulation, then modifying program state within 7 blocks after the user signed. Blockaid developed the Lighthouse Protocol to counter this, injecting assertion instructions into transactions that cause them to fail if conditions change post-simulation.

Simulation Environment Detection

Malicious contracts can attempt to detect when they are running in a simulated environment versus on-chain execution. By checking for environmental cues (block number patterns, gas pricing anomalies, or the presence of specific state), contracts can behave benignly during simulation and activate malicious logic only when executed for real. This is an active area of cat-and-mouse between attackers and simulation providers.

Centralization Risk

The simulation industry has consolidated around a small number of providers. Blockaid alone powers security for the majority of major wallets. A vulnerability in a dominant provider could immediately affect millions of users across dozens of wallet products. The Coinspect research team highlighted this risk after discovering a flaw in Blowfish's Solana transaction parsing in 2023: the assign instruction was not flagged, allowing attackers to transfer account ownership while the simulation showed a benign transfer.

False Sense of Security

Simulation is a powerful layer of defense, but it is not a complete security solution. Users who rely solely on simulation without understanding what they are signing remain vulnerable to novel attack vectors. Simulation works best as one component of a broader security posture that includes using a hardware signing device, revoking unused token approvals, and verifying contract addresses through audited sources.

Why It Matters

Wallet drainer phishing attacks stole $494 million in 2024, a 67% increase from the prior year, affecting 332,000 addresses. Transaction simulation is the primary defense against these attacks at the wallet layer. Its rapid adoption (from experimental opt-in to default-on across major wallets in under two years) reflects both the scale of the threat and the effectiveness of the technology.

For builders on platforms like Spark, transaction simulation represents a critical UX and security consideration. Wallets and embedded wallet integrations that surface clear transaction previews build user trust and reduce the risk of costly mistakes. As blockchain transactions become more complex and DeFi interactions involve deeper contract call chains, simulation evolves from a nice-to-have security feature into essential infrastructure.

For a deeper look at wallet security threats and the role of simulation in mitigating them, see the research on AI wallet security attack surfaces and address poisoning attack defense.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.