MetaMask now prevents red pill attacks with new Added Protection security feature

Red pill attacks are a sneaky scam that exploits a blind spot in how many crypto wallets work: before you approve a transaction on an app, your wallet shows you a preview of what should happen. But that preview is only a simulation, and nothing has ever forced the real transaction to match it, so a malicious contract can slip right through.

MetaMask’s new Added Protection security feature changes that. When you’re transacting with apps, the outcome you see in the preview is the result you get, or the transaction doesn't go through.

Red pill attacks: the scam that hides in a transaction preview

A red pill attack happens because a malicious contract can tell when it's being previewed, so it plays nice—showing you a clean, harmless result like "You will receive 0.1 ETH." Then you sign, it runs, and does something completely different: like emptying your wallet. Because the preview looked perfectly fine, you had no reason to hesitate.

How MetaMask Added Protection works

Before you sign a transaction via an app, we simulate it, and show you the expected result—the same preview you see today. We lock that result into the transaction as a requirement. When the transaction actually runs, the outcome has to match what you were shown. If it doesn't—say a red pill contract tries to do something other than what it promised—the transaction fails automatically, and your funds never leave your wallet.

If that happens, the only thing you lose is the network (gas) fee for the attempt, and your funds are kept safe. MetaMask doesn’t charge anything for this security feature, or on the transaction that didn’t go through. Added Protection guards against manipulated outcomes, not ordinary market shifts. It works quietly in the background, and it's especially useful when you're approving a large transaction or dealing with a contract you don't know well.

Security that keeps you in control

Like everything we build, Added Protection keeps you safer without taking away control. MetaMask won't block a transaction you meant to make, the security feature just promises one thing: the transaction you approve on an Ethereum or EVM app is the transaction that actually runs.  If you'd rather manage the risk yourself, you can switch the feature off at anytime, right in the confirmation screen. The choice is always yours.

MetaMask Added Protection is now live on extension (v13.45) across the 13 EVM networks that support smart accounts (EIP-7702), with mobile to follow.