How to simulate a transaction before signing to see what it does
You are about to sign a transaction. You have read the raw data. Maybe you decoded it using a contract ABI. But you still do not know exactly what will happen to your tokens.
Simulation tools solve this. They let you preview every state change before you commit, and this is the single most effective defense against blind-signing phishing attacks.
What simulation shows you
A transaction simulation replays the intended execution in a sandboxed environment. It does not send anything to the blockchain. Instead, it shows you:
- Balance changes. Your wallet's exact token and native asset balances before and after the transaction.
- State diffs. Every storage slot the transaction modifies across all contracts it touches.
- Token movements. Which tokens move, in what direction, and to or from which addresses.
- Approval changes. Whether the transaction grants an allowance to a contract, and for what amount.
- Internal calls. Any sub-calls the transaction triggers, including delegatecalls.
Two block explorers provide this for free: Tenderly and Phalcon. Both accept a transaction hash or raw transaction data as input.
How to use Tenderly
Tenderly's transaction simulator works with both pending and historical transactions. You can also paste raw signed transaction hex.
- Go to the Tenderly transaction simulator page.
- Paste your raw transaction data or a transaction hash.
- Select the correct network from the dropdown.
- Click "Simulate Transaction."
The result shows a before/after balance table. Each asset your wallet holds appears with its starting and ending balance. Any approval changes appear as a separate line item. Tenderly also shows you the full call trace, and you can expand each internal call to see its inputs, outputs, and gas consumption.
How to use Phalcon
Phalcon offers a similar service. It emphasizes visual clarity for token flows.
- Navigate to the Phalcon explorer.
- Choose "Transaction Simulation" from the tools menu.
- Paste the transaction hash or raw data.
- Select the chain.
Phalcon draws arrows between addresses. A red arrow means tokens leave your wallet. A green arrow means tokens arrive. This visual mapping makes phishing approvals obvious: you see your USDC heading to an address you do not recognize.
Why simulation matters
Phishing attacks rely on blind signing. A malicious dApp asks you to sign a transaction that looks innocuous in your wallet's prompt. Your wallet might show "Approve USDC spending limit" with an address you cannot verify in a few seconds. Simulation catches this. The simulation shows the actual recipient address, the exact allowance amount, and whether the contract can transfer your tokens arbitrarily afterward.
Some phishing attempts use permit-style signatures. These do not require a transaction broadcast; they work through off-chain signatures that the attacker submits later. Simulation cannot catch those. For permit-style approvals, you must inspect the message hash and domain separately.
Limitations you must know
Simulation has three gaps.
First, it cannot predict future state changes. If the transaction calls an oracle that returns different data at a later block, the simulation result may diverge from reality.
Second, simulation assumes all external calls succeed. A transaction that only works if a specific price feed returns a certain value will simulate correctly now, yet it may fail when you actually broadcast it.
Third, simulation tools show you what the code would do. They cannot tell you whether the code is malicious in a subtle way. A contract could simulate as a harmless swap, then later change its behavior through a proxy upgrade.
When to simulate
Simulate every transaction you did not initiate from a trusted dApp you have used hundreds of times. Simulate every approval for a token you care about. Simulate any transaction that appears to grant unlimited allowances.
Do not simulate transactions you are about to broadcast from a trusted interface you have verified manually. That adds friction without proportionally more safety.
Simulation is a tool, not a guarantee. Use it alongside transaction decoding and allowance checks. Together they form a defense that makes blind signing difficult for attackers to exploit.
Not financial advice. basiliskawakens.xyz publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.