MetaMask transaction security now blocks scams that fake your preview

en.cryptonomist.ch 1 h

Security

MetaMask has rolled out a new safeguard designed to close a dangerous gap in how crypto wallets confirm what a transaction actually does. The update, called Added Protection, strengthens MetaMask transaction security by forcing a hard match between what a transaction preview promises and what actually happens on-chain — and if the two don’t line up, the transaction is automatically stopped before it can cause damage.

Key takeaways

MetaMask launched Added Protection, a feature that compares a transaction’s predicted outcome with its real result before letting it complete.
If the outcome doesn’t match the preview, the transaction fails automatically and the user only loses the attempted gas fee.
The feature is enabled by default starting with MetaMask extension version 13.45.
It covers 13 EVM networks that support EIP-7702 smart accounts.
MetaMask says the tool is built specifically to guard against so-called Red Pill attacks.

MetaMask introduces Added Protection for transaction security

Added Protection works on a simple but powerful principle: what you’re shown before signing has to match what actually happens once the transaction settles on-chain. This directly targets one of the oldest tricks in crypto scams — showing a wallet a harmless-looking preview while the actual transaction does something entirely different, like draining funds or approving malicious contract access.

Feature requires transaction outcomes to match previews

Every Ethereum or EVM transaction processed through a wallet with Added Protection enabled must produce a result identical to what was previewed beforehand. That means a user isn’t just trusting a static preview screen anymore; the wallet actively checks whether the on-chain execution matches expectations before finalizing anything. This is a meaningful shift in how MetaMask transaction security is enforced at the protocol level, moving from passive display to active verification.

Automatic failure mechanism limits user loss to gas fee

When a mismatch occurs, the transaction doesn’t go through. Instead, it fails automatically, and the only cost to the user is the gas fee that was already spent attempting the transaction. In practice, this caps the financial downside of a manipulated transaction attempt — no funds are moved, no permissions are granted, and no assets change hands beyond the gas already paid. That’s a notable improvement over previous wallet behavior, where a deceptive transaction could execute fully and result in a total loss of funds rather than just a small fee.

Scope and deployment details of Added Protection

Added Protection is already live and switched on for most users, rather than sitting behind an opt-in toggle. MetaMask enabled it by default on extension version 13.45, meaning anyone running that version or later gets this layer of MetaMask transaction security automatically, without needing to change settings.

Enabled by default on MetaMask extension 13.45

Because the protection ships as a default setting rather than an optional feature, adoption happens immediately across the user base running the updated extension. This lowers the chance that vulnerable or less security-aware users skip the safeguard simply because they didn’t know it existed.

Supports 13 EVM networks with EIP-7702 smart accounts

The feature currently covers 13 EVM networks that support EIP-7702 smart accounts, an Ethereum standard that expands how accounts can execute and batch transactions. Tying Added Protection to EIP-7702 smart accounts specifically suggests MetaMask is prioritizing the networks where this newer account model is already active, since that’s where the outcome-versus-preview verification can be most reliably enforced.

Security purpose against Red Pill attacks

MetaMask says Added Protection is built to guard against Red Pill attacks, a category of exploit aimed at tricking a wallet’s transaction preview so it displays one outcome while a different, harmful action actually executes. By requiring the real result to match the preview exactly, the feature is designed to neutralize that gap between what users see and what actually happens on-chain — closing off a manipulation vector that has made Red Pill attacks on Ethereum and other EVM chains particularly hard to catch before it’s too late.

For everyday wallet holders, this matters because transaction previews have long been treated as trustworthy by default. If a preview can be spoofed while the underlying transaction does something else entirely, users have no reliable way to know they’re about to get scammed until after the damage is done. Added Protection effectively removes that blind trust by putting a verification check between the preview and the final execution.

FAQ

What is MetaMask’s Added Protection feature?

Added Protection is a security feature that requires Ethereum or EVM transaction outcomes to match their previews, automatically failing if they differ.