Rabby transaction simulation and risk alerts
Before you sign, Rabby simulates the transaction against the latest block and shows the expected balance changes, plus risk alerts about the contract, the recipient and any approvals. It is one of Rabby's main safety features, but a simulation is a prediction, not a guarantee.
Most wallet losses happen at the signing screen: someone signs a transaction or approval they did not understand. Rabby's main safety feature is that it shows what a transaction is expected to do before you sign it, in plain terms such as "-1,000 USDC, +0.31 ETH".
What Rabby shows before you sign
- Simulation Results: the tokens and NFTs that are expected to leave and enter your wallet. Rabby notes that the "Simulation executed in the latest block".
- Action summary: a readable description of what you are doing, such as a swap, a token approval, an NFT approval or a send.
- Contract and recipient details: whether you have interacted with this address before ("Never interacted before"), when the contract was deployed ("Deployed time") and whether Rabby marks it as trusted or blocked.
- Approval details: the spender, the amount (including unlimited approvals) and a "trust value", which Rabby describes as "the total asset value spent by this contract. A low trust value indicates either risk or inactivity for 180 days."
- Token warnings: for example "This is a scam token marked by Rabby" or "This is potentially a low-quality and scam token based on Rabby's detection".
- Gas: the estimated network fee, with slow, normal, fast and custom options.
The same checks apply to signature requests (messages and typed data such as permits), where Rabby decodes what you are agreeing to as far as it can. This matters because permit-style signatures can give away tokens without any on-chain transaction from you.
(UI text quoted from the Rabby extension, October 2026.)
When Rabby runs its checks
- When you connect to a site: the security engine checks the site and can warn you, for example if it appears on a phishing list.
- When you sign a transaction: simulation plus rules about the recipient, contract, tokens and approvals.
- When you sign a message or typed data: decoding and rules for permits, orders and other signatures.
- In Rabby's own Swap and Bridge: since August 2026, a transaction preview for these too (Rabby source code, August 2026).
What it catches in practice
| Situation | What you would see |
|---|---|
| A "claim airdrop" site asks for an unlimited approval | An approval to an unknown spender with a low trust value, often a contract you have never interacted with |
| A fake token airdropped to your wallet | A scam token warning when you try to interact with it |
| Sending to a look-alike address from your history (address poisoning) | A recipient you have never transacted with, or one Rabby marks as a scam address |
| A swap where you receive far less than quoted | A warning that the simulated amount is lower than the DEX offer |
| A transaction that would fail | "Simulation Failed", which saves you a failed transaction and its gas |
For address checks, our EVM address checker compares two addresses character by character.
Risk alerts and "Ignore all"
Rabby's security engine runs rules on each request and labels results by risk level. Some warnings can be ignored after you confirm "I understand and accept responsibility for any loss". The most serious cannot: Rabby shows "Found forbidden risk that can't be ignored" and blocks signing.
There is also an Ignore all button for non-forbidden alerts. CryptoSlate notes that this lets you sign after a risk warning (CryptoSlate, October 2026). Use it only when you know exactly why the alert appeared. You can mark addresses as trusted or blocked yourself, and you can view or disable individual security rules, though Rabby recommends keeping them on.
Many scam pages tell you to "ignore the warning" or claim the alert is a bug. That is a red flag in itself.
The limits of simulation
A simulation is very useful, but it is not proof. Know its blind spots:
- State can change before your transaction lands. Prices move, other transactions are included first, and front-running can change the result. Slippage settings protect swaps; other transactions have no such protection.
- Approvals are about the future. An approval shows no balance change today. The risk comes later, when the spender can move your tokens. Read the spender and the amount, not just the empty balance change, and test unfamiliar data with our approval risk explainer.
- Off-chain signatures such as permits do not move funds at signing time, so the balance preview can look harmless.
- Malicious contracts can behave differently in a simulation than in real execution, for example by checking conditions that differ at the moment of inclusion.
- Not every chain is supported. On some chains and custom networks Rabby shows "Simulation Not Supported" or "Transaction simulation not supported on this chain". If the security engine is down, Rabby says the result is unknown.
- Fake Rabby extensions fake the simulation. A counterfeit extension can show any screen it likes. Verify yours with our Rabby extension checker.
Simulation also does not protect your seed phrase. Rabby never asks for it, and no simulation can stop someone who has it.
Simulation with a hardware wallet
A hardware wallet's small screen often shows only a contract address and raw data, which is hard to judge. With Rabby, you see the decoded action, the simulated balance changes and the risk alerts on your computer first, and only then confirm on the device. That combination is one of the main reasons hardware-wallet users pick Rabby. Still check the recipient or spender address on the device screen itself, because malware on your computer could change what the browser shows. See Rabby with Ledger.
Settings that affect protection
- Security rules: keep them on. Rabby says when rules are disabled and lets you turn them back on.
- Custom RPC: a custom node replaces Rabby's. If it fails, Rabby offers to disable it and continue with its official RPC. A bad RPC can show wrong balances.
- Trusted and blocked marks: marking an address as trusted silences some warnings, so use it only for addresses you have verified.
- Auto-lock: a short auto-lock time limits what anyone with access to your unlocked computer can do.
How to read the signing screen in 20 seconds
- Check the site in the request is the one you meant to use.
- Read the balance changes. Is anything leaving your wallet that you did not expect?
- If it is an approval, check the spender and the amount. Prefer a limited amount over unlimited.
- Read every risk alert. Do not click Ignore all on a site you found through an ad, DM or airdrop link.
- If anything is unclear, reject. Rejecting costs nothing.
If you already signed something bad
- Disconnect from the site and close it.
- Open Rabby's approvals page and revoke any approval you do not recognise, starting with unlimited ones.
- If you signed a permit or approval that has already been used, move your remaining funds to a new wallet with a new seed phrase.
- If you typed your seed phrase anywhere, treat the wallet as compromised and move everything at once.
- Ignore anyone who contacts you offering to recover funds. Recovery offers after a theft are almost always a second scam.
Old approvals you no longer need can be removed with Rabby's approvals manager. For the wider security picture, read is Rabby Wallet safe?.
Frequently asked questions
Does Rabby simulate every transaction?
Rabby simulates transactions before signing on the chains where simulation is available. On some chains and custom networks it shows that simulation is not supported.
Can the simulation be wrong?
Yes. It runs against the latest block, so price moves, front-running or contracts that behave differently at execution can change the result.
Why does an approval show no balance change?
Because nothing moves when you approve. The risk is that the spender can move your tokens later, so check the spender and the amount.
What does Ignore all do?
It lets you sign despite non-forbidden risk alerts. Forbidden risks cannot be ignored. Use Ignore all only when you fully understand the alert.
Does simulation protect me from fake Rabby extensions?
No. A fake extension can show a fake simulation. Check the extension ID and install only from the official store listing.