lization with Fallback Health Checks Single-endpoint dependencies cause audit failures during network congestion. We initialize a provider array with automatic fallback and latency-based routing.

import { ethers, JsonRpcProvider } from "ethers";

const RPC_ENDPOINTS = [
  "https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY",
  "https://rpc.ankr.com/eth",
  "https://cloudflare-eth.com"
];

class ResilientProvider {
  private providers: JsonRpcProvider[];
  private activeIndex: number = 0;

  constructor(endpoints: string[]) {
    this.providers = endpoints.map(url => new JsonRpcProvider(url));
  }

  async getProvider(): Promise<JsonRpcProvider> {
    for (let i = 0; i < this.providers.length; i++) {
      const idx = (this.activeIndex + i) % this.providers.length;
      try {
        await this.providers[idx].getBlockNumber();
        this.activeIndex = idx;
        return this.providers[idx];
      } catch {
        continue;
      }
    }
    throw new Error("All RPC endpoints failed health check");
  }
}

Rationale: Health checks prevent silent failures. Rotating the active index distributes load and avoids rate-limit blacklisting. This pattern is essential for production environments where RPC stability directly impacts audit completeness.

Step 2: Chunked Log Extraction for Historical Permissions

Blockchain nodes restrict log query ranges. Fetching full history in a single call triggers execution reverted or timeout errors. We implement block-range chunking with configurable batch sizes.

const APPROVAL_TOPIC = "0x8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925";
const APPROVAL_FOR_ALL_TOPIC = "0x17307eab39ab6107e8899845ad3d59bd9653f200f220920489ca2b5937696c31";

interface PermissionRecord {
  tokenAddress: string;
  spender: string;
  amount: bigint;
  blockNumber: number;
  txHash: string;
  type: "ERC20" | "ERC721_1155";
}

async function fetchHistoricalPermissions(
  provider: JsonRpcProvider,
  targetWallet: string,
  chunkSize: number = 10000
): Promise<PermissionRecord[]> {
  const latestBlock = await provider.getBlockNumber();
  const results: PermissionRecord[] = [];
  let fromBlock = 0;

  while (fromBlock <= latestBlock) {
    const toBlock = Math.min(fromBlock + chunkSize, latestBlock);
    
    try {
      const [erc20Logs, erc721Logs] = await Promise.all([
        provider.getLogs({
          address: ethers.ZeroAddress, // Wildcard for all tokens
          topics: [APPROVAL_TOPIC, ethers.zeroPadValue(targetWallet, 32)],
          fromBlock, toBlock
        }),
        provider.getLogs({
          address: ethers.ZeroAddress,
          topics: [APPROVAL_FOR_ALL_TOPIC, ethers.zeroPadValue(targetWallet, 32)],
          fromBlock, toBlock
        })
      ]);

      erc20Logs.forEach(log => {
        const spender = ethers.getAddress("0x" + log.topics[2].slice(26));
        const amount = BigInt(log.data);
        results.push({
          tokenAddress: log.address,
          spender,
          amount,
          blockNumber: log.blockNumber,
          txHash: log.transactionHash,
          type: "ERC20"
        });
      });

      erc721Logs.forEach(log => {
        const approved = log.topics[2] === ethers.zeroPadValue(targetWallet, 32);
        if (approved) {
          const operator = ethers.getAddress("0x" + log.topics[1].slice(26));
          results.push({
            tokenAddress: log.address,
            spender: operator,
            amount: BigInt(1), // Boolean flag for setApprovalForAll
            blockNumber: log.blockNumber,
            txHash: log.transactionHash,
            type: "ERC721_1155"
          });
        }
      });
    } catch (err) {
      console.warn(`Chunk ${fromBlock}-${toBlock} failed, retrying...`, err);
      continue;
    }

    fromBlock = toBlock + 1;
  }

  return results;
}

Rationale: Parallel fetching of ERC-20 and ERC-721/1155 events reduces latency. Chunking prevents RPC timeouts. Wildcard address filtering captures approvals across all token contracts without requiring prior contract discovery.

Step 3: Risk Scoring Engine

Raw permission data lacks context. We apply a deterministic scoring model that weights unlimited approvals, known malicious spenders, and recency.

const KNOWN_MALICIOUS = new Set([
  "0x1234567890abcdef1234567890abcdef12345678",
  "0xdead000000000000000000000000000000000000"
]);

function evaluateRiskScore(record: PermissionRecord): number {
  let score = 0;
  
  if (record.amount === ethers.MaxUint256) score += 40;
  if (KNOWN_MALICIOUS.has(record.spender.toLowerCase())) score += 50;
  if (record.type === "ERC721_1155") score += 20;
  
  const daysSinceGrant = (Date.now() / 1000 - record.blockNumber * 12) / 86400;
  if (daysSinceGrant > 180) score += 10;
  
  return Math.min(score, 100);
}

function generateAuditReport(records: PermissionRecord[]): Array<PermissionRecord & { riskScore: number }> {
  return records
    .map(r => ({ ...r, riskScore: evaluateRiskScore(r) }))
    .sort((a, b) => b.riskScore - a.riskScore);
}

Rationale: Separating risk evaluation from data fetching enables unit testing and policy updates without modifying ingestion logic. The scoring model is transparent, deterministic, and easily extensible with external threat intelligence feeds.

Pitfall Guide

Pitfall	Explanation	Fix
Blind Trust in Wallet UI Labels	Wallet interfaces often truncate calldata or display generic "Approve" text, masking setApprovalForAll or malicious fallback functions.	Always decode raw transaction input or use standardized parsers like ethers.Interface before confirming.
Ignoring ERC-721/1155 Blanket Permissions	setApprovalForAll grants operator control over entire NFT collections, not individual tokens. Many auditors only check ERC-20 limits.	Explicitly filter topic 0x17307eab39ab6107e8899845ad3d59bd9653f200f220920489ca2b5937696c31 and treat boolean approvals as high-risk.
RPC Rate Limit Exhaustion	Querying full block history in one request triggers 429 Too Many Requests or node timeouts, causing incomplete audits.	Implement chunked log retrieval with exponential backoff and respect provider rate limits.
Cross-Chain Permission Blind Spots	Users assume EVM audits cover all assets, but approvals on BSC, Polygon, or Arbitrum remain active even if Ethereum is cleaned.	Maintain chain-specific provider pools and aggregate results into a unified permission ledger.
Dust Token Interaction Traps	Unknown tokens sent to wallets may contain malicious transfer or fallback functions that trigger unauthorized approvals when moved.	Treat unrecognized tokens as read-only. Never initiate transfers or approvals for unverified contracts.
Hardcoded Endpoint Dependencies	Single RPC failure during audit execution breaks the pipeline, leaving permissions unverified during critical windows.	Use provider fallback arrays with health checks and automatic routing to the lowest-latency endpoint.
Signature Request Ambiguity	personal_sign and eth_sign lack structured data validation, enabling phishing sites to forge transaction intent.	Enforce EIP-712 (eth_signTypedData_v4) for all financial operations and reject raw message signing.

Production Bundle

Action Checklist

• Initialize resilient provider pool with health checks and fallback routing
• Configure chunked log extraction with block range limits matching RPC constraints
• Implement deterministic risk scoring with external threat intelligence integration
• Set up automated revocation pipeline for high-risk permissions (score > 70)
• Deploy cross-chain permission aggregation for multi-network wallets
• Schedule periodic audits (bi-weekly for active wallets, monthly for cold storage)
• Integrate alerting via webhook or messaging platform for real-time permission changes

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
High-value cold storage (> $100k)	Manual review + hardware wallet isolation	Minimizes attack surface; automated revocation risks misfires	Low (human time)
Active DeFi trader	Integrated monitoring stack + auto-revoke thresholds	High permission churn requires real-time detection	Medium (infra + dev)
NFT collector	ERC-721/1155 focused audit + operator revocation	Blanket approvals are common and high-risk in NFT markets	Low (compute)
Multi-chain operations	Aggregated cross-chain scanner + unified ledger	Prevents permission drift across L2s and sidechains	High (API costs + orchestration)

Configuration Template

// audit.config.ts
export const AUDIT_CONFIG = {
  chains: {
    ethereum: {
      rpcEndpoints: [
        "https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY",
        "https://rpc.ankr.com/eth"
      ],
      chunkSize: 10000,
      maxRetries: 3
    },
    polygon: {
      rpcEndpoints: ["https://polygon-rpc.com", "https://rpc.ankr.com/polygon"],
      chunkSize: 50000,
      maxRetries: 3
    }
  },
  riskThresholds: {
    critical: 80,
    warning: 50,
    info: 20
  },
  output: {
    format: "json",
    path: "./reports/wallet-audit-{timestamp}.json",
    includeRawLogs: false
  },
  notifications: {
    webhookUrl: process.env.SECURITY_WEBHOOK_URL,
    enabled: true
  }
};

Quick Start Guide

1. Install dependencies: npm install ethers@6
2. Configure environment: Copy audit.config.ts, replace RPC endpoints with your provider keys, and set SECURITY_WEBHOOK_URL for alerts.
3. Execute initial scan: Run the auditor against your target wallet address. The script will chunk historical logs, apply risk scoring, and output a sorted JSON report.
4. Review and revoke: Open the generated report, filter entries with riskScore >= 80, and use Revoke.cash or direct contract calls to revoke high-risk permissions.
5. Schedule monitoring: Deploy the WebSocket listener from the core solution to track new approvals in real-time, triggering alerts when thresholds are breached.

This framework transforms wallet security from a reactive checklist into a continuous, data-driven discipline. By treating permissions as auditable state, developers can enforce least-privilege principles across decentralized ecosystems while maintaining operational velocity.