# NoClipX — MetaMask “Malicious site” warning: review guide

**Status: unresolved.** NoClipX is a **Base Sepolia-only testnet experiment**. The prior MetaMask warning occurred when attempting an ERC-20 NCLX transfer. Neither a successful testnet transaction nor a source-based review proves the classification is incorrect.

## Do not bypass the protection

Until reviewed, do not connect a wallet to the flagged site or sign new transactions through it. **Do not turn off MetaMask security alerts** as a fix, and never share a Secret Recovery Phrase, private key, or wallet password with support.

## Identify the actual type of warning

1. Was **“Malicious site”** displayed at **connect**, **before signing**, or in the **transaction-confirmation modal**?
2. Preserve an **existing** screenshot of the alert including the wording, domain, any “See details” text and warning identifiers. Do not reproduce an unsafe interaction just to obtain a screenshot.
3. Note MetaMask version and platform, Base Sepolia chain ID **84532**, exact public domain `https://noclipx-project.pages.dev/`, public testnet contract `0x71ebef1e89db768eb760f8cb60cf421db42981b5`, and the approximate time of the warning.
4. For confirmation-modal alerts, choose **See details → Report an issue**, if available. For URL/token/address warnings, MetaMask directs owners to **MetaMask Support** for manual classification review.
5. A genuine browser phishing-site interstitial can also be reported to the MetaMask phishing-detect GitHub issues tracker, if this is the provider that flagged it.

## Official channels

- MetaMask Security Alerts / false classification reports: https://support.metamask.io/configure/wallet/security-alerts
- Contact MetaMask Support: https://support.metamask.io/
- Deceptive-site warning and blocklist report route: https://support.metamask.io/stay-safe/safety-in-web3/deceptive-site-ahead-when-trying-to-connect-to-a-site/
- GitHub issue tracker used for MetaMask phishing list reports: https://github.com/MetaMask/eth-phishing-detect/issues
- Testnet contract explorer: https://sepolia.basescan.org/address/0x71ebef1e89db768eb760f8cb60cf421db42981b5#code

## Useful findings from *this project's source code* (not an audit)

- The NoClipX Wallet Portal submits ERC-20 `transfer(address,uint256)` data (`0xa9059cbb`) via a MetaMask `eth_sendTransaction` request to the **fixed NCLX contract**, with `value: 0x0`, following an explicit user action and wallet/network checks. (`portal.js`)
- LX AI, Blockchain Explorer and Analytics use **read-only RPC requests**. The Analytics page does not request wallet permissions, initiate transfers, or call RPC by itself.
- The portal is explicitly restricted to **Base Sepolia**. Base Mainnet has not been enabled.
- **These observations do not determine why MetaMask generated the warning**, and do not establish an independent security audit. Ask MetaMask to review the exact site, payload and classification.

## Review-request information (no sensitive data)

**Subject:** Request for manual review — MetaMask “Malicious site” warning on NoClipX Base Sepolia testnet

We operate the experimental NoClipX site at `https://noclipx-project.pages.dev/` on Base Sepolia (chain ID 84532), using ERC-20 testnet contract `0x71ebef1e89db768eb760f8cb60cf421db42981b5`. MetaMask displayed a “Malicious site” security alert during a transfer workflow. We have suspended further wallet transfer tests pending clarification and request a manual review of the security classification and the specific risk signal that triggered it.

The web app's transfer path requests a user-confirmed `eth_sendTransaction` for an ERC-20 `transfer` call to this fixed contract; the other public blockchain dashboard features are read-only. We do not claim that the warning is a false positive without your investigation. We can provide an existing screenshot, browser/extension versions and transaction metadata without revealing private wallet credentials. Please let us know which evidence is needed and whether the classification refers to the domain, contract, address, or transaction simulation.

**Never attach or send:** seed phrases, private keys, browser profiles, exported wallet vaults, passwords, signing challenges or sensitive wallet credentials.