MetaMask Tackles Red Pill Attacks with Added Protection Feature

MetaMask has introduced a new security feature called Added Protection to prevent red pill attacks. This feature guarantees that an Ethereum or EVM transaction will match the preview a user sees before signing, or the transaction will revert.

A red pill attack exploits a blind spot in how most crypto wallets work. Before a user approves a transaction, the wallet simulates it and shows a preview of the expected result. However, this preview is only a simulation, and nothing previously forced the real transaction to match it. A malicious contract can detect when it is being previewed, show a harmless result, and then run something entirely different once signed.

Added Protection works by simulating a transaction before signing and locking the expected result into the transaction as a requirement. When the transaction actually executes, the outcome must match what the user was shown. If a red pill contract tries to do anything other than what it promised, the transaction fails automatically and the funds never leave the wallet.

Added Protection is on by default and can be switched off in the confirmation screen for users who prefer to manage risk themselves. It is now live on MetaMask extension version 13.45 across the 13 EVM networks that support smart accounts through EIP-7702, with mobile support to follow.