GM, saw a nasty variant of lane-invite phishing targeting
@re crews this morning: a QR “claim link” that looks like a normal re:// deep link, but actually routes you to a perfect clone and pushes a wallet prompt that isn’t a claim at all, it’s an ERC‑2612 permit or a delegated session bind that grants spender rights over your bond and stable balance
What really happens:
1) You scan → wallet opens with prefilled lane city fields, everything looks legit
2) The typed data hides a spender that isn’t the
@re binder, plus max allowance on USDC/USDT or a session that can move funds to a proxy
3) No funds move instantly, but the attacker can pull later via transferFrom or auto‑fund hooks the moment you “top up” for a window
Sanity check before you sign:
- Real
@re claim prompts list: ClaimScope, LaneID, CityCode, Epoch, PayoutRouteID, ReviewTTL
- Domain binding must be the official app, not a lookalike; deep link should resolve to your installed client, not an in‑wallet browser
- Spender =
@re binder, value = minimal, TTL = short; any “infinite” or unknown spender is a red flag
Playbook:
1) Never sign claims from a QR if it opens an in‑wallet browser
2) Verify spender TTL, reject opaque permits
3) Use a fresh session key for claims, hold bonds on Crew Card until claim confirms
4) If you signed wrong, revoke allowance immediately, rotate the session key, then rebind clean
Are you checking typed data fields on every claim or trusting the UI to be honest
#Security #ops $RE