Blockaid False Positive? How to Get Your dApp Cleared

Video transcript

A red wallet warning can stop users before they see your app. It is a risk signal, not proof of fraud, and a false positive can be fixed and reported.

Blockaid scans dApps before connection, simulates transactions and screens tokens. Wallets also run their own checks, so first name exactly what was flagged.

Common triggers in wallet and chain guidance include new domains, unverified contracts, broad approvals, and transactions that fail simulation or mismatch the screen. Opaque proxies weaken the evidence too. Blockaid does not publish its full rule set.

PumpForge, in its own account, named unlimited approvals as the likely trigger. After moving to exact amounts with a thirty minute Permit2 expiry, it reported the warning gone that day.

Beyond each first fix, deploy these before you resubmit. Lock implementation initializers, request exact amounts, show the call and spender first, and simulate every transaction.

Then report through Blockaid's support portal, tell each wallet, such as MetaMask or Phantom, and retest every wallet you support.

Send everyone the same evidence: the hostname, chain ID and addresses, explorer verification links, the flagged transaction, screenshots, and audit links.

Never tell users to switch off alerts. If a warning survives your fixes, pause the flow and check your code, DNS and dependencies for compromise.

Read the full guide. Guardian Managed Security watches the domains, DNS and certificates behind a domain warning, with an engineer who responds when alerts fire.

Why Wallets Flag dApps

A red warning at the connect button stops users before they see your app. For a new launch, it reads like a scam label.

That warning is a risk classification, not a finding of fraud. MetaMask says its alerts weigh phishing reports, contract behavior, impersonation signals, onchain activity and community reports. MetaMask

This guide is for the team behind a flagged app. For how Blockaid compares with other security vendors, see our Hypernative vs Hexagate vs Blockaid comparison.

Blockaid runs inside wallets as separate checks. It scans a dApp before the user connects, simulates each transaction and screens tokens. Blockaid

Its transaction alerts look for unexpected transfers, approvals and permission changes. Its dApp scan looks for phishing, spoofed frontends and scam behavior.

Not every warning comes from Blockaid. Phantom, for example, shows its own warning when it cannot simulate a transaction accurately. Phantom

So start by naming the flagged object: the domain, a contract address, a token or a single transaction. Each one has a different fix.

Common False-Positive Triggers

Blockaid does not publish its full rule set, a false-positive rate or a removal deadline. Most triggers below come from wallet and chain documentation; the proxy row is our inference from how proxies work.

Proxies are normal. OpenZeppelin's pattern forwards every call to an implementation contract that an upgrade admin can replace. OpenZeppelin

If that implementation is unverified, or the admin is unclear, a scanner has less evidence for a safe verdict.

Not a known trigger, but worth closing first: Guardian's public Footium report rated an uninitialized implementation Low, now Resolved. Anyone could initialize it directly, enabling phishing and operator confusion. Guardian

Unlimited approvals are a plausible trigger, not a confirmed rule. Wallet scanners check for unexpected approvals, and Base asks apps to request only what a transaction needs. Blockaid, Base Documentation

PumpForge's own account, filed October 1, 2026, names unlimited approvals, including to newly deployed bonding-curve contracts, as the likely trigger. MetaMask/GitHub

After switching to exact amounts with 30-minute Permit2 expiry, it reported the warning gone that day.

Drainer kits rely on the same pattern, as our Permit2 phishing explainer shows: unlimited, long-lived allowances to unknown spenders.

Reporting a Blockaid False Positive

Fix any trigger that applies before you report, so the reviewer sees the current version. If nothing needs fixing, report straight away with the evidence below.

Blockaid's public route is its support portal, report.blockaid.io. It separates scam reports, false-positive reports and project verification. Blockaid

The false-positive form sits at report.blockaid.io/mistake. We found no public list of its required fields, so send the full package below.

Base's documentation sends builders to the same portal, both to verify an app and to report a mistaken flag. Base Documentation

In MetaMask, Report an issue under See details covers transaction alerts only. For a flagged URL, token or address, contact MetaMask support with the flagged item, network, screenshots and official verification links. MetaMask

MetaMask also keeps a public domain blocklist, eth-phishing-detect, on GitHub. Its issue tracker takes blocklist removal requests. MetaMask/GitHub

MetaMask's alerts draw on partners including Blockaid, so a warning can appear when your domain is not on that list. The bullpunch.xyz team said exactly that in October 2026, blaming Blockaid's dApp scan.

If a Phantom new-domain warning lasts beyond a week, Phantom asks teams to use its domain review form. Phantom

Send the same evidence to every channel. Reviewers then judge one set of facts.

• Exact hostname, any redirects, and the page where the warning appears.
• Chain ID, contract addresses and the implementation address behind each proxy.
• Explorer verification links for every contract and implementation.
• The flagged transaction hash or calldata, including any approval amount requested.
• Screenshots of the warning, with wallet name, wallet version and time observed.
• Links to published audits, official docs and official social accounts.
• What you changed since the flag, with deployment dates.

Fixes in Contracts and Frontend

The table above gives each trigger's first fix. Deploy these as well before you resubmit.

• Call _disableInitializers() in each implementation constructor so nobody can initialize it directly. OpenZeppelin, Guardian
• Replace unlimited approvals with exact amounts, and give Permit2 signatures short expiries. Base Documentation, MetaMask/GitHub
• Show the call, spender and amount on screen before the wallet prompt opens.
• Simulate every transaction your app builds before sending it to the wallet. Phantom
• Publish audit reports at stable links a reviewer can open.

Preventing Future Flags

Flags tend to follow change: a new domain, a new contract or a new flow. Build the checks into each release.

Before launch, file a project verification request through Blockaid's portal instead of waiting to report a mistake. Blockaid, Base Documentation

Launch contracts already verified, with audits linked from your docs. Keep the frontend stable around launch day.

After each release, load the app in every wallet you support. Log any new warning as an incident ticket.

Guardian's pentests check wallet connection and signing: whether the payload that gets signed matches what the user saw and approved. Guardian

In Managed Security, Shield covers the hosts, certificates and names that lead users to you, and Sentry watches the domains, DNS and certificates behind a domain warning.

When the Flag Is Real

Never tell users to switch off alerts or click through. If a warning survives your fixes, treat it as possibly correct.

Pause the affected flow. Then compare the JavaScript your site serves with your last known-good build.

Check registrar events, nameservers, DNS records and new certificates. Our DNS hijack prevention checklist lists the alerts to set.

Check your dependencies. Our guide to dApp frontend supply chain security covers compromised npm releases that put drainers into trusted packages.

Check onchain authority too: recent upgrades, role changes and approvals pointing to addresses you do not recognize.

If you confirm a compromise, warn users on channels off the affected domain and publish the addresses to revoke.

A wallet flag can be the first outside signal of an attack. Clearing it is the last step, not the first.

Frequently Asked Questions

How long does a false-positive review take?

MetaMask says reviews are case by case and can take several business days. In one October 2026 GitHub request, MetaMask said the site was already unflagged, though the team said its Blockaid report, filed three days earlier, had no reply. MetaMask, MetaMask/GitHub

Will a Blockaid correction clear the warning in every wallet?

Not necessarily. Wallets run their own checks alongside Blockaid's, so an independent or cached classification can outlast a Blockaid correction. Retest in each wallet you support after Blockaid replies. MetaMask

Can a token be flagged when the site is clean?

Yes. Blockaid screens tokens separately, for spoofed assets, impersonator tokens, honeypots and illiquid tokens. Uniswap Labs added Blockaid token validation to its web app and wallet in December 2024, so token labels can appear there too. Blockaid, Uniswap Labs

Can users still proceed past a MetaMask alert?

Yes. MetaMask lets users confirm despite an alert, and says its simulations do not catch every threat. A clean scan is not proof of safety either. MetaMask

Related reading

• hypernative vs hexagate vs blockaid
• defi dns hijack prevention
• dapp frontend supply chain security
• permit2 phishing
• what is offchain security

Sources

• Blockaid: Blockaid Support Portal
• Base Documentation: How to Avoid Getting Your App Flagged as Malicious
• MetaMask: How to manage security alerts to protect your wallet
• Phantom: Domain and transaction warnings
• Phantom: This dApp could be malicious warning
• OpenZeppelin: Proxy Upgrade Pattern
• Blockaid: Rainbow Wallet: Mobile App and Browser Extension Powered By Blockaid (December 6, 2023)
• Blockaid: Blockaid Expands Protection to the NuFi Wallet (October 29, 2025)
• Uniswap Labs: New Token Warnings and Labels on Uniswap Web and Wallet
• Guardian: Longshot Protocol Review
• Guardian: Footium Protocol Review: L-01 Implementation Can Be Initialized Directly
• OpenZeppelin: Writing Upgradeable Contracts: Initializing the Implementation Contract
• MetaMask/GitHub: MetaMask eth-phishing-detect
• MetaMask/GitHub: MetaMask eth-phishing-detect Issues
• MetaMask/GitHub: Blocklist removal request: app.pumpforge.tech (false positive, Blockaid dApp scan) #298754
• MetaMask/GitHub: Blocklist removal request: bullpunch.xyz (false positive, Blockaid dApp scan) #302865
• Blockaid: Blockaid Contact Us
• Blockaid: Blockaid Support Portal: Mistake route
• Guardian: Blockchain Penetration Testing Services
• Guardian: Managed Digital Asset Security Services