A field guide to browsing Web3 safely — before you connect, before you sign, before you send.教您辨別每次連接網站、簽名、轉帳的風險
Messiah checks websites, transactions and addresses, then explains what it found in plain language. This guide covers what each check does — and what to do with the answer.Messiah 會檢查網站、交易和地址，再用白話告訴您它發現了什麼。這份教學說明每種檢查的用途，以及拿到結果之後該怎麼做。
Add Messiah from the Chrome Web Store, then pin it to your toolbar.
從 Chrome 線上應用程式商店加入 Messiah，然後把它釘選到工具列。
New accounts start with 5 free credits. Each scan uses one. You can top up from the extension when they run out.
新帳號有 5 點免費點數，每次掃描用掉 1 點。用完了隨時可以在擴充功能裡加值。
Messiah loads with the page. If a dApp was already open when you installed it, refresh that tab.
Messiah 會隨頁面一起載入。如果安裝前 dApp 已經開著，記得重新整理那個分頁。
Messiah loads with the page, so without a refresh it is not attached to that tab. When a transaction is sent from there, no review window appears: your wallet asks for your signature with nothing checked in between.
Messiah 是隨頁面一起載入的，沒有重新整理就沒有接上那個頁面。之後在那裡送出交易時，Messiah 的審查視窗不會跳出來，錢包會直接要您簽名，等於完全跳過了這一關。
Check a website before you connect your wallet.連接錢包之前，先檢查這個網站。
Open the site you are about to use.
打開您準備使用的網站。
Click the Messiah icon, then the Site tab.
點 Messiah 圖示，切到網站分頁。
Click Scan Website. Results come back in seconds.
按下掃描網站，幾秒內就有結果。
This page copies a well-known wallet and asks for your recovery phrase. It is a phishing site.這個頁面仿冒知名錢包，還要您輸入助記詞。這是釣魚網站。
| Verdict判定 | Meaning意思 | What to do建議動作 |
|---|---|---|
| Safe安全 | Nothing suspicious found沒有發現可疑之處 | Carry on放心繼續 |
| Caution注意 | Minor concerns worth knowing有些值得知道的小狀況 | Read the findings, then decide讀完列出的發現再決定 |
| Warning警告 | Real risk indicators present存在實際的風險跡象 | Do not connect unless you are certain除非非常確定，不要連接 |
| Danger危險 | Strong signs of a scam or phishing site有明顯的詐騙或釣魚跡象 | Leave. Do not connect your wallet離開，不要連接錢包 |
It says Safe. Does that guarantee the site is legitimate?顯示「安全」，代表網站一定沒問題嗎？
No tool can promise that. Safe means we found no known indicators of an attack. Keep your own judgement, especially for sites you reached through a link in a message, email or ad.
沒有工具能打這種包票。「安全」的意思是我們沒有找到已知的攻擊跡象。自己還是要判斷，尤其是從私訊、Email 或廣告連結點進來的網站。
A site I trust came back as Caution.我信任的網站被判為「注意」。
Caution is not an accusation. Something is worth a second look: an unfamiliar script host, a very new domain, a login form. Read the findings before you decide.
「注意」不是在指控誰，只是有東西值得多看一眼：陌生的腳本來源、剛註冊沒多久的網域、一個登入表單。決定之前先讀過列出的發現。
A site is asking for my seed phrase.有網站要我輸入助記詞。
Leave. No wallet, exchange or support agent ever needs it. There is no exception to this.
馬上離開。任何錢包、交易所或客服都不需要您的助記詞，沒有例外。
See what a transaction actually does before you approve it.批准之前，先看清楚這筆交易到底會做什麼。
Nothing to set up. When a dApp asks your wallet to sign something, Messiah steps in first and shows you a review.
不用任何設定。dApp 要求您的錢包簽名時，Messiah 會先一步跳出來，給您一份審查報告。
If a review window appears before your wallet does, Messiah is working. Nothing reaches the blockchain until you press Proceed.
審查視窗比錢包先出現，就代表 Messiah 正在運作。在您按下「繼續」之前，什麼都不會送上區塊鏈。
A dApp is requesting to sign a transaction. Review carefully before proceeding.dApp 正在要求簽署交易，請仔細審查後再繼續。
The site says you are minting a free NFT, but this transaction grants a third-party contract permission to transfer every ORBIT NFT you own, at any time. The contract is unverified and was deployed two days ago. Reject this request.網站聲稱您在免費鑄造 NFT，但這筆交易其實是授權一個第三方合約隨時轉走您持有的所有 ORBIT NFT。該合約未驗證，兩天前才部署。建議拒絕這筆請求。
I understand the risks and want to proceed anyway我瞭解風險並希望繼續執行
Asset changes — what leaves and enters your wallet, simulated before you sign.
資產變動：在您簽名之前先模擬一次，顯示哪些資產會離開、哪些會進到您的錢包。
Verdict — one level for the transaction as a whole.
判定：整筆交易的整體風險等級。
What this transaction does — the request in plain language, and why it might be risky.
這筆交易會做什麼：把請求內容講成白話，並說明可能的風險在哪。
Risk findings — each concern on its own line with its own level, so you can see which parts are fine and which need attention.
風險發現：每個疑慮各佔一行、各有等級，一眼就能看出哪些部分沒事、哪些要注意。
High-risk requests need a confirmation tick before Proceed, so nothing dangerous gets approved by reflex.
高風險的請求要先勾選確認才按得下「繼續」，避免手一滑就批准了危險的操作。
Why was my transaction intercepted? Is something broken?我的交易為什麼被攔截？是壞掉了嗎？
No. That is the protection working. Messiah holds every signing request so you can see what it does first.
沒有壞，這正是保護在運作。Messiah 會攔下每一筆簽名請求，讓您先看清楚它要做什麼。
What does "unlimited approval" mean?「無上限授權」是什麼意思？
Before you can trade a token on a decentralised exchange, you grant the exchange permission to move it. Most exchanges ask for unlimited permission by default so you do not have to approve again on every trade. Nearly all of them work this way.
在去中心化交易所交易代幣之前，您要先授權交易所動用那個代幣。多數交易所預設會要求無上限的授權，這樣您不必每筆交易都重新授權一次，幾乎所有交易所都是這樣運作的。
The trade-off is that the permission never expires. If that contract is ever compromised, your tokens can be taken without you signing anything new.
代價是這個授權永遠不會過期。哪天那個合約被入侵了，您的代幣可能在您沒簽任何新東西的情況下被轉走。
You can set your own spending cap in your wallet, or leave it and revoke the approval afterwards at revoke.cash.
您可以在錢包裡自己設定授權額度，或先照常使用、事後到 revoke.cash 撤銷授權。
Messiah says Caution but the site looks legitimate.Messiah 顯示「注意」，但網站看起來沒問題。
Caution means check this, not this is a scam. A well-known exchange asking for unlimited approval is a real risk worth knowing about, and the exchange is still legitimate. If the transaction matches what you set out to do and you understand the flagged item, it is your call.
「注意」的意思是「看一下這個」，不是「這是詐騙」。知名交易所要求無上限授權，是值得知道的實際風險，但交易所本身還是正當的。如果交易內容符合您原本要做的事，被標記的項目您也了解，那就由您決定。
No review window appeared.沒有出現審查視窗。
The page was probably loaded before Messiah was installed or updated. Refresh it and try again.
頁面八成是在 Messiah 安裝或更新之前就載入了。重新整理再試一次。
Look up who you are about to send to.轉帳之前，先查清楚對方是誰。
Open Messiah, then the Address tab.
打開 Messiah，切到地址分頁。
Paste any wallet or contract address.
貼上任何錢包或合約地址。
Pick the network and click Check address.
選好網路，按下查詢地址。
This address has been flagged for phishing activity and appears in community scam reports. Do not send funds or approve tokens for it.這個地址已被標記為釣魚活動，並出現在社群詐騙檢舉中。不要向它轉帳或授權代幣。
| Source來源 | What it tells you告訴您什麼 |
|---|---|
| Etherscan | Wallet or contract, whether the code is published, how old it is, how active是錢包還是合約、程式碼有沒有公開、地址存在多久、有多活躍 |
| GoPlus | Known malicious contracts and flagged tokens已知的惡意合約和被標記的代幣 |
| Chainabuse | Addresses the community has reported as scams被社群檢舉為詐騙的地址 |
| Revoke.cash | A direct link to review and revoke your approvals直達連結，方便您檢視並撤銷授權 |
What does "unverified contract" mean?「未驗證合約」是什麼意思？
The source code has not been published on the block explorer, so nobody can read what it really does. Plenty of legitimate contracts are unverified, but alongside other signals it is a reason to slow down.
代表開發者沒有把原始碼公開到區塊鏈瀏覽器上，沒有人能讀到它實際在做什麼。很多正當的合約也沒驗證，但要是同時出現其他訊號，就值得放慢腳步。
What is an EIP-7702 delegation warning?EIP-7702 委託警告是什麼？
A recent Ethereum upgrade, live on BNB Chain since the Pascal hardfork, lets an ordinary wallet borrow the abilities of a smart contract. Wallet providers use it for genuinely useful things: paying fees in tokens, or batching several actions into one signature. When that happens, your wallet is delegated to a contract.
以太坊近期的一項升級（BNB Chain 從 Pascal 硬分叉起支援）讓普通錢包可以借用智慧合約的能力。錢包商拿它做很實用的事：用代幣付手續費，或把好幾個操作合併成一次簽名。這時您的錢包就「委託」給了一個合約。
Attackers can use the same mechanism. If someone gets access to a wallet, they can delegate it to a contract that sweeps out anything that arrives.
攻擊者也會用同一套機制。要是有人拿到錢包的存取權，就能把它委託給一個會自動掃走所有進帳的合約。
Messiah reads which contract the wallet points to and checks that contract against threat intelligence, so you can tell a normal smart-account setup from a wallet that has been taken over.
Messiah 會讀出錢包指向哪個合約，再拿威脅情資查核那個合約，幫您分辨這是正常的智慧帳戶設定，還是一個已經被接管的錢包。
Revoke the delegation and move your funds to a new wallet.
撤銷委託，把資產移到新錢包。
The balance looks too low for this address.餘額看起來比實際少。
Address check shows the native coin balance only, not tokens, NFTs or staked assets. A wallet can hold almost no ETH or BNB and still hold a great deal in tokens.
地址查詢只顯示原生幣餘額，不含代幣、NFT 或質押中的資產。一個錢包可能幾乎沒有 ETH 或 BNB，代幣卻抱了一大堆。
The same four levels apply across every check.四個等級，適用於所有檢查。
| Level等級 | What it means代表什麼 |
|---|---|
| Safe安全 | No known risk indicators. Carry on.沒有已知的風險跡象，放心繼續。 |
| Caution注意 | Worth understanding before you continue. Often legitimate. For example, an unlimited token approval on a well-known exchange.繼續之前值得弄懂，而且常常是正當的。例如知名交易所的無上限代幣授權。 |
| Warning警告 | Real risk indicators found. Only continue if you understand why they are there.找到了實際的風險跡象。除非您了解它們為什麼出現，否則不要繼續。 |
| Danger危險 | Strong evidence of an attack. Do not proceed. If it is a signing request, reject it.有攻擊的強烈證據。不要繼續；如果是簽名請求，直接拒絕。 |
It will show up on legitimate sites sometimes. That is the point: some perfectly ordinary actions carry risk worth knowing about. Messiah tells you what and why, then leaves the decision with you.
正當的網站偶爾也會出現「注意」，這正是設計的用意：有些再平常不過的操作，本身就帶著值得知道的風險。Messiah 告訴您是什麼、為什麼，決定權留給您。
No. When you run a scan or review a transaction, the relevant page content or transaction data goes to our API, gets analysed in real time, and is not kept once the request finishes. Your API key stays in your browser's local storage and is never shared with third parties.
不會。您執行掃描或審查交易時，相關的頁面內容或交易資料會送到我們的 API 即時分析，請求結束後不會保留。您的 API 金鑰只存在瀏覽器的本機儲存空間，不會分享給第三方。
No. It cannot move, sign or spend anything. It reads what a site or transaction is asking for and shows it to you. Every decision stays with you and your wallet.
動不了。它無法移轉、簽名或花費任何東西，只是把網站或交易的請求內容讀出來給您看。每個決定都在您和您的錢包手上。
Transaction review works across major EVM networks. Address checks currently cover Ethereum, Polygon and Arbitrum.
交易審查支援主要的 EVM 網路。地址查詢目前涵蓋 Ethereum、Polygon 和 Arbitrum。
English, Traditional Chinese, Simplified Chinese, Japanese and Korean.
英文、繁體中文、簡體中文、日文、韓文。
New accounts get 5 free credits and each scan uses one. Top up any time from the extension.
新帳號有 5 點免費點數，每次掃描用掉 1 點。隨時可以在擴充功能裡加值。
Email ask@onesavie.com.
來信 ask@onesavie.com。
Messiah