Payment Scam Prevention

{
  "factor": "address_poisoning_attack",
  "risk_level": "high",
  "description": "Potential address poisoning attack detected - recipient matches poison address pattern"
}

{
  "factor": "new_wallet_recipient",
  "risk_level": "high",
  "description": "Recipient is a completely new wallet with no transaction history"
}

{
  "factor": "first_interaction",
  "risk_level": "high",
  "description": "First ever interaction between these addresses"
}

async function checkPaymentForScams(sender, recipient, amount, network) {
  const params = new URLSearchParams({
    sender_address: sender,
    recipient_address: recipient,
    amount: amount.toString(),
    sender_network: network,
    recipient_network: network,
  });

  const response = await fetch(
    `https://api.range.org/v1/risk/payment?${params}`,
    { headers: { Authorization: `Bearer ${API_KEY}` } }
  );

  return response.json();
}

function analyzeScamRisk(paymentRisk) {
  const factors = paymentRisk.risk_factors || [];

  const scamIndicators = {
    addressPoisoning: factors.find((f) => f.factor === "address_poisoning_attack"),
    newWallet: factors.find((f) => f.factor === "new_wallet_recipient"),
    firstInteraction: factors.find((f) => f.factor === "first_interaction"),
    limitedHistory: factors.find((f) => f.factor === "limited_interaction_history"),
    maliciousRecipient: factors.find(
      (f) => f.factor === "malicious_address_recipient" && f.risk_level === "high"
    ),
  };

  // Address poisoning is always a critical warning
  if (scamIndicators.addressPoisoning) {
    return {
      level: "critical",
      warning: "Address poisoning detected",
      description: "This address closely matches another address you've transacted with. " +
        "Scammers create lookalike addresses to trick you into sending funds to them.",
      recommendation: "Do NOT send to this address. Verify the full address character by character.",
    };
  }

  // New wallet + first interaction = strong scam signal
  if (
    scamIndicators.newWallet?.risk_level === "high" &&
    scamIndicators.firstInteraction
  ) {
    return {
      level: "high",
      warning: "Possible scam - new wallet with no prior interaction",
      description: "This recipient has no transaction history and you've never sent to them before. " +
        "This pattern is common in impersonation, phishing, and advance-fee scams.",
      recommendation: "Verify the recipient through a trusted channel before sending.",
    };
  }

  // First interaction alone is a caution
  if (scamIndicators.firstInteraction) {
    return {
      level: "medium",
      warning: "First-time recipient",
      description: "You've never sent to this address before. Double-check the address is correct.",
      recommendation: "Consider sending a small test amount first.",
    };
  }

  return { level: "low", warning: null };
}

async function protectedSend(sender, recipient, amount, network) {
  const paymentRisk = await checkPaymentForScams(
    sender, recipient, amount, network
  );

  const scamAnalysis = analyzeScamRisk(paymentRisk);

  switch (scamAnalysis.level) {
    case "critical":
      // Block and show red warning - do not allow without explicit override
      return showCriticalWarning(scamAnalysis);

    case "high":
      // Show prominent warning, require confirmation
      const confirmed = await showHighRiskWarning(scamAnalysis);
      if (!confirmed) return { status: "cancelled" };
      break;

    case "medium":
      // Show informational notice
      await showCautionNotice(scamAnalysis);
      break;
  }

  // Proceed with transaction
  return await executeTransaction(sender, recipient, amount);
}