A DeFi trader approves a token swap on a familiar-looking interface, expecting to receive 100 USDC in exchange for their position. The transaction executes, but instead of the quoted output, the wallet drains entirely. The smart contract they interacted with was not the one advertised; the approval they signed was broad; or the transaction path itself had been manipulated. These scenarios happen with regularity in decentralized finance because most wallet interfaces show a user only the raw transaction data—hex strings, contract addresses, and function calls that are opaque to ordinary readers.

Rabby Wallet approaches this problem by performing transaction simulation before the user signs. Rather than simply displaying a contract address and a function name, Rabby simulates the transaction against the blockchain state, predicts what will actually happen, translates the result into plain language, and applies risk labels to flag suspicious patterns. This process does not prevent all scams, but it closes a critical gap: users can now see the real consequences of their action before they become irreversible.

What transaction simulation actually does

Transaction simulation is not a guarantee or a whitelist. It is a prediction engine that reconstructs what a transaction will do by running it against a copy of the current blockchain state without actually broadcasting it. Rabby fetches the user’s account balances, the smart contract code, and the network state from an RPC endpoint, then executes the transaction logic step by step. The wallet records which tokens would be transferred, which addresses would receive them, which allowances would be granted, and what the user’s portfolio would look like after execution.

This simulation happens locally on the user’s device before they ever see a signature request. The wallet translates the results into human-readable predictions: “You will send 1 ETH and receive approximately 2,500 USDC” or “This transaction will grant permission to spend your entire token balance.” Users can then compare these predictions against their intent. If a swap promised 2,500 USDC but the simulation shows 200 USDC, the mismatch is immediately visible. If a token approval is supposed to be limited to one contract but the simulated permission is unlimited, a red flag appears.

The technical foundation is important because it explains both what transaction simulation can and cannot do. The simulation uses the most recent on-chain state, which means it reflects current token prices, liquidity pools, and smart contract code. If conditions change between simulation and broadcast—for example, another transaction clears a liquidity pool or a contract is updated—the actual result may differ from the prediction. This is the reason warnings about slippage and market conditions exist. Transaction simulation is not a guarantee that the quoted output will be received; it is a snapshot prediction based on the state at the moment of preview.

Crucially, transaction simulation also cannot read the user’s intent from their mind. If a user deliberately wants to grant unlimited approval to a contract they trust, the wallet will flag it as a high-risk pattern—because unlimited approvals are objectively a common vector for theft if the contract is later compromised. The warning is accurate, but the user may still choose to proceed. The simulation provides information; the user retains the decision.

How scam detection integrates with transaction preview

Rabby combines transaction simulation with a separate risk-labeling system that flags patterns associated with known attack vectors. These patterns include unlimited token approvals, transactions directed to suspicious addresses, contract calls that do not match the promised function, and interactions with contracts that have been flagged by security auditors or community reports. When a user attempts to sign a transaction, Rabby checks against these patterns and overlays warnings on the preview.

The scam protection filters work by maintaining a database of known malicious addresses, phishing contracts, and compromised tokens. This database is updated regularly and can flag contracts that impersonate legitimate protocols, addresses that are associated with previous exploits, or tokens that have been identified as honeypots or rug pulls. A honeypot token, for example, allows purchases on decentralized exchanges but blocks sells; a rug-pull contract typically has a hidden withdrawal function that lets the deployer drain liquidity.

When combined with transaction simulation, these warnings become much more actionable. A user might see: “You are interacting with a contract flagged for suspicious activity. Simulation shows you will receive 0 tokens in return.” The simulation adds specificity. It is one thing to say a contract is suspicious; it is another to show that the transaction will literally produce zero output, which is a clear indicator of failure or theft.

The effectiveness of this approach depends on the quality of the flagging database and the accuracy of the simulation. If a contract is not in the known-bad list, no warning will appear even if it is malicious. This is why Rabby also surfaces the simulation results themselves as a primary safety layer. If the simulation shows an unexpected result—say, a large amount being transferred to an unfamiliar address—the user should recognize it as suspicious regardless of whether the contract has been flagged before. Transaction simulation is therefore both a technical defense and a tool for user education.

Transaction simulation for different transaction types

Token swaps are the most common use case because they involve multiple steps—exchanging one asset for another, handling slippage, and routing through liquidity pools—that are difficult for users to verify manually. Rabby simulates the entire swap path and shows the expected token output, the impact of slippage, and any intermediate steps. For a swap through Uniswap, the simulation reveals the exact amount of the output token that will be received, allowing the user to compare against the quoted rate and decide whether to proceed.

Smart contract interactions present a different challenge because they can perform arbitrary functions. Minting an NFT, staking tokens, voting in a governance proposal, or interacting with a lending protocol all go through contract calls that most users do not understand. Transaction simulation translates these calls into predicted outcomes. For an NFT mint, it shows which NFTs would be received. For a stake, it shows the before-and-after balance and the allowances granted. For a governance vote, it confirms the proposal and voting direction without requiring the user to read bytecode.

Approval transactions deserve particular attention because they are high-impact but low-visibility. When a user interacts with a decentralized exchange or lending protocol, the wallet typically shows an approval step that grants permission to transfer tokens. Approval transactions do not actually move tokens themselves; they set a spending limit that the contract can draw from later. A malicious approval can grant unlimited spending rights, which means that if the contract is later compromised or proves to be fraudulent, the attacker can steal all approved tokens. Transaction simulation flags these permissions explicitly and shows the maximum amount that can be spent, allowing the user to reduce the limit if necessary.

Practical limits of pre-signing preview

Transaction simulation is powerful, but it operates within the constraints of blockchain data and the information available at preview time. If a user is interacting with a contract that has not yet been deployed or a smart contract that uses obscure logic, transaction simulation may fail or produce unexpected results. The wallet will typically display this as an error or a warning that simulation was not available, prompting the user to be more cautious.

Time-dependent transactions present another challenge. Some smart contracts include time locks or conditions that depend on when the transaction executes. If a prediction is made at 10:00 AM but the transaction is broadcast at 10:05 AM and conditions have changed, the simulated result may not match the actual outcome. This is particularly relevant for MEV (miner extractable value) protection and flash loan attacks, where the timing and ordering of transactions can be manipulated. Transaction simulation shows what would happen given the current state, but it cannot protect against attacks that exploit the gap between signing and confirmation.

The database of flagged addresses and contracts is also incomplete by definition. A newly deployed scam contract will not be in the known-bad list until it is discovered, reported, and added to the database. This lag time means that transaction simulation cannot catch every scam on day one. The protection is strongest for repeat attack patterns and known malicious actors, which covers a significant portion of real-world scams but not all of them.

Users should also understand that transaction simulation reflects the state of the wallet’s connected node. If the node is out of sync, misconfigured, or providing false data, the simulation could be misleading. This is why running a personal node or using multiple RPC endpoints adds another layer of verification. For high-value transactions, comparing simulation results across different endpoints or services can help confirm that the prediction is accurate.

How Rabby integrates transaction simulation across platforms

Rabby is available as a browser extension for Chrome, Brave, Edge, and Opera, a mobile app for iOS and Android, and a desktop client for Windows and macOS. Each platform implements transaction simulation with the same core logic, but the interface and user experience vary. The browser extension shows the simulation preview in a pop-up window whenever a dApp requests a transaction signature. The mobile app integrates the preview into a full-screen confirmation dialog. The desktop client provides the most detailed view, with expandable sections showing the predicted token transfers and risk labels.

The consistency across platforms means a user who understands how to read simulation results in the browser extension can recognize the same information in the mobile app. This matters for security because habits form across platforms. If a user always checks the simulation preview before approving a transaction on desktop, they are more likely to do the same on mobile, even though mobile interfaces are often more cramped and harder to read carefully.

Hardware wallet integration with Ledger, Trezor, and OneKey adds another dimension. When a user connects a hardware wallet to Rabby, the transaction simulation still happens on the device before the user is prompted to approve on the hardware device. This means the hardware device itself does not need to understand smart contract code or perform expensive simulations; Rabby does that work and presents the user with a clear, signed message on the hardware device asking them to confirm the action. The hardware device verifies that they approved the message, and the transaction proceeds. This architecture keeps the private key on the hardware device—the most secure location—while still providing the user with human-readable information about what they are approving.

Real-world scenarios where transaction simulation stops attacks

Consider a scenario where a user receives a link to what appears to be a legitimate NFT marketplace. They connect their wallet, find an NFT they want, and attempt to purchase. Without transaction simulation, the user might see only the contract address and a generic “approve” message. With transaction simulation, Rabby reveals that the transaction will not actually transfer an NFT at all—instead, it will approve an unlimited spend of their wallet’s ETH balance. The user can then close the tab, report the site, and avoid losing their funds.

Another common attack is the “fake token” scam, where a contract mimics a legitimate token’s name and symbol but implements a hidden sell function that does not work. A user might be promised a free airdrop of “UNI-Clone,” receive it in their wallet, and then try to sell it on Uniswap. Transaction simulation would show that any attempt to sell returns zero tokens, making the scam immediately visible. Without the simulation, the user might click through multiple transactions, increasing the risk of losing gas fees and attention to the fact that something is wrong.

Rug pulls on decentralized exchanges represent a third category. A new token launches with an attractive yield or community promise, liquidity is provided by the project team, and early buyers join. When the team decides to exit, they use a hidden function to drain the liquidity pool and disappear. Rabby cannot prevent this if the rug pull has not yet occurred, but once it has, transaction simulation will reveal that any attempt to sell the token produces nearly zero output. Users checking before they buy into a project—by simulating a hypothetical sell transaction—can see this risk pattern and avoid the project entirely.

For those looking to set up protections and understand Rabby’s full capabilities, the rabby wallet browser extension can be installed directly and includes built-in guidance on enabling transaction simulation and scam protection. The setup process allows users to choose which detection features to enable and customize their security preferences.

Setting up transaction simulation and monitoring preferences

Rabby enables transaction simulation by default, but users can customize how the feature behaves. In the settings, users can choose the strictness level of risk warnings—whether to flag all unusual patterns or only the most severe ones. They can also enable or disable specific protection categories, such as filtering known phishing sites or checking for suspicious smart contracts. These choices allow users to balance security with convenience; for example, a developer interacting with experimental contracts might lower the warning threshold to avoid constant prompts, while a casual user might keep warnings at maximum sensitivity.

The wallet also maintains a whitelist feature that allows users to mark certain addresses and contracts as trusted. Once an address is whitelisted, transaction simulation will still show predictions, but risk warnings will not appear for interactions with that address. This is useful for reducing alert fatigue when a user regularly interacts with the same DeFi protocols or sends funds to the same recipient address. The whitelist does not disable transaction simulation; it simply allows the user to acknowledge and accept patterns they have already evaluated.

Users can also review the history of past transactions and simulations within Rabby, which provides a record of what was predicted versus what actually executed. If a transaction had significant slippage or an unexpected outcome, reviewing the simulation can help the user understand whether the prediction was inaccurate or whether conditions changed between preview and broadcast. This feedback loop helps users develop more accurate intuition about when to be cautious and when to proceed.

The limits of perfect prediction

No wallet can guarantee that transaction simulation will prevent all scams. The technology works best against repeat patterns, known malicious actors, and simple deception—phishing sites, honeypot tokens, unlimited approvals, and rug pulls that have already been identified. More sophisticated attacks that exploit protocol-level vulnerabilities, use flash loans to manipulate prices in real time, or employ novel social engineering require additional defenses beyond what transaction simulation provides.

Security is therefore cumulative. Transaction simulation is one layer, scam protection filters are another, user education is a third, and careful behavioral practices—checking URLs before connecting wallets, never sharing recovery phrases, using hardware wallets for large balances—are essential as well. A user who relies entirely on Rabby’s transaction simulation while ignoring these other practices is less secure than one who uses simulation as part of a broader security routine.

The wallet also cannot protect against regulatory changes, exchange rate volatility, or legitimate but unfavorable contract terms. If a user deliberately approves a contract they trust, gets exploited through a compromise of that contract, the simulation did its job correctly—it warned them of the risk and they chose to proceed anyway. The transaction simulation showed the real consequences; the user made a conscious decision. This is the correct outcome from a security perspective, even if the user later regrets it.