SlothSigner：在瀏覽器中檢查錢包交易並解釋風險

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Stedy(https://dev.to/challenges/hacktoberfest-week3-2026-10-19)

What I Built

SlothSigner is a browser tool that reads a wallet transaction before you sign it.

Crypto people get burned by rubber-stamping approvals. The hex looks like noise. You click Confirm because decoding it yourself is work. SlothSigner does that work for you.

You paste calldata (or tap a sample). Fixed rules return Safe, Check, or Danger on a torn paper receipt. Then Gemma writes a short plain-language explanation inside the card. No wallet connect. No server model. The model runs in your browser through WebLLM.

Who it's for: anyone who signs approvals, transfers, or permits and does not want to read raw hex every time.

What effort it saves: you stop manually decoding spender addresses, allowances, and function selectors before every risky click.

Demo: https://youtube.com/shorts/VlmhPf586ss?si=jCkw2WLqnjQXOT6Z

Live app: https://slothsigner.vercel.app

Open the site in Chrome or Edge.
Tap Unlimited USDC approve.
Tap Explain this to me.
Read the Danger receipt. Wait for Gemma's explanation to fill in under the verdict.

Link to Code

(https://github.com/Yungtimmy/SlothSigner)

# How I Built It

Open AI at the core:

Google Gemma gemma3-1b-it-q4f16_1-MLC through WebLLM
Local inference in the browser (no API key, no backend LLM)

The stack:

Static frontend (Vite)
Rule engine for Safe / Check / Danger
Decoders for approvals, transfers, setApprovalForAll, permit, and Permit2
Unknown selectors looked up via 4byte, then marked Check
Receipt UI: moss on paper, Fraunces for the verdict, IBM Plex Mono for calldata

Design choice that matters: rules pick the verdict. Gemma only writes the explanation. A tiny model should not be the safety gate. It should explain the risk in human words after the gate has fired.

The brand follows the theme on purpose. Signing should feel slow. The download screen, the reading state, and the receipt are part of that.

Built during the Week 3 window as a new public repo.

The Lazy Payoff

Before SlothSigner, checking an unlimited USDC approve meant pasting hex into a decoder, reading a spender, checking the allowance, and hoping you did not miss a selector.

Now: one paste, one tap, one receipt. The hard part of reading the transaction is automated. You still decide whether to sign. You just stop doing unpaid forensic work every time a dapp asks.

Why Does Open Innovation Matter?

Wallet safety should not depend on a closed scanner you cannot inspect.

SlothSigner uses an open-weight Gemma build and open WebLLM runtime so:

transaction data stays in the browser
anyone can fork the rules and the prompt
there is no per-request model bill after the one-time download
the verdict logic is visible in the repo, not hidden behind an API

A closed "AI security" product can change behavior overnight. An open receipt you can read, fork, and audit matches how people already treat wallets: verify, then trust.

# Prize Categories

Best Use of Gemma