Curriculum·G204 Tools a Non-Developer Can Run·about 29 min
Simulating a transaction before you sign
By the end of this lesson you can
- →Explain what a transaction simulation does: run the exact payload against a fork and report the real net effect before you sign
- →Explain how the WazirX signers approved a 230 million dollar theft because the interface showed a different transaction than the one they signed
- →Compute the gap between what an interface claims a transaction does and what its calldata actually does
- →Simulate a transaction and read its asset changes and permission changes before authorizing it
Graduate · enrolled learners
This lesson opens with WazirX, 18 July 2024.
- What happened
- WazirX, a large Indian exchange, held funds in a Gnosis Safe multisig operated through the Liminal custody interface. On 18 July 2024 about 230 million dollars was drained in a single transaction. The signers approved what their interface displayed as a routine, expected transfer, but the payload they actually authorized replaced the Safe's logic with an attacker-controlled contract, handing over the wallet. The data shown on screen and the data sent for signature did not match. Investigators attributed the operation to the North Korea-aligned Lazarus group, which had staged the mismatch so that honest signers, reading their own interface, would authorize their own loss. A simulation of the actual calldata against a fork would have reported that the transaction changed the wallet's implementation rather than moving the funds it claimed to move.
- The decision point
- The WazirX signers did exactly what they were supposed to do, read the transaction and approved it, and the transaction they read was not the transaction they signed. This is the failure a simulation exists to catch. A simulation does not trust the interface's description; it runs the exact bytes that will be signed against a copy of the chain and reports what actually happens: which balances change, which permissions are granted, whether the contract's own logic is being replaced. The decision a user faces before every signature is whether they know what the payload does, and the honest answer, absent a simulation, is that they know only what the screen claims. Closing that gap is a tool a non-developer can run, and it is the difference between reading a promise and reading the effect.
- Recorded loss
- $230,000,000
What you will be able to answer
- →Why did the WazirX signers approve the theft?
- →What does a transaction simulation do?
- →Absent a simulation, what does a signer know?
- →A simulation contradicts the interface. Which do you trust?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.elliptic.co/blog/wazirx-hack-lazarus-group
- https://rekt.news/wazirx-rekt/
- https://docs.tenderly.co/simulations
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The WazirX loss is reported at roughly 230 to 235 million dollars; the exact figure varies by asset prices at the time of the theft. The precise mechanism of the interface-versus-payload mismatch was reconstructed by investigators and WazirX and some operational details remain disputed between the parties.
Simulation tools and wallet built-in previews differ in coverage and can miss effects that depend on external state at execution time; a simulation reduces but does not eliminate signing risk.