Check a payment.
Paste L, B or P into HexFence Pay on the demo Safe. Connect a Sepolia wallet that owns a Safe to sign and send.
Open HexFence PayGuided demo / five steps / no wallet
Watch one lookalike payment fail.
Evidence comes from Arkiv, with a dated saved copy if the live read fails. The demo Safe, its Guard and the recorded payments' receipts are read from Sepolia. The verdicts are computed in your browser.
Part 1 is real Ethereum mainnet evidence, status suspected. Parts 2–5 are a synthetic re-enactment on Sepolia with addresses we generated, not a real attack.
-
Step 1 · Ethereum mainnet · read from Arkiv
Poisoning is happening on Ethereum.
The HexFence detector publishes suspected address-poisoning records to Arkiv. Here are its published records and the latest record in this read.
Reading published evidence…
-
Step 2 · the trick
Same start, same end, different address.
Our demo Safe pays one approved supplier, P. We generated L to share P's first 4 and last 4 characters. In a transaction history, that is often all anyone reads.
-
Step 3 · Sepolia · read from the chain
The Safe and its Guard.
The demo Safe's active guard and its approved payees, read once in bulk from Sepolia. This page reads directly, not through Nox; HexFence Pay uses Nox.
Reading the demo Safe…
-
Step 4 · in your browser
Before you sign: three verdicts.
The same verdict logic HexFence Pay uses, run here on the payees from step 3. Nothing about these recipients is sent anywhere.
Waiting for the approved payees…
-
Step 5 · Sepolia · recorded payments
At execution: the Guard decides.
These payments were sent from the demo Safe by a script wallet, not by a person in Safe{Wallet}. Their status is read live from each receipt.
Reading receipts…
Your turn
Do it yourself.
Inspect the evidence.
Search records, re-check their Ethereum receipts, and look at campaigns and suspected losses.
Open evidence explorer