Phantom Solana — dangerous-payload signing UI battery
Web-bugs-class signing payloads. Goal: verify Phantom signing prompt clearly decodes and flags each. DO NOT APPROVE. Goal is to observe UI text, then reject.
0. Connect Phantom Solana
Tests
1. SetAuthority — hand account ownership to attacker (Solana drainer class, $90M H1 2025)
2. Token Approve — delegate full balance to attacker
3. Hidden SystemProgram::Transfer at instruction 8 of 9 (Memo-disguise pattern)
4. CPI: outer Memo only, inner Token::Transfer via CPI (Phantom should still decode)
5. Versioned tx v0 with ALT lookup (skill F3 — does prompt show resolved accounts?)
6. Fee-payer swap — user signs as fee-payer for attacker tx
7. Durable-nonce tx (skill F1 — does prompt warn about delayed broadcast?)
Log