Airdrop safety checklist: 10 steps before you connect, how signature drainers work, and how Nova Points claims run inside the wallet — no signature-first sites.
Airdrop hunting is the most-scammed activity in crypto. The pattern is so common it has a name — the signature drainer: a fake "claim" page that asks your wallet for one signature, and that signature is an unlimited approval that empties you later. The full mechanics: how wallet drainers actually work.
The Nova Points claim flow runs inside the wallet UI: read the balance, click claim, done. No third-party claim site, no signature-first flow, no deadline panic — and Nova Shield screens every external request you do make against drainer lists, before you sign. Claim safety is the default, not an add-on.
Related reading: address poisoning: why your history lies · blind signing vs simulation · off-chain threats.
Read the domain carefully (lookalikes are the #1 trick), refuse any 'claim' that requires a signature first, and never paste your recovery phrase on a site. A signature authorizes — a claim just reads. Nova Shield screens external requests against signed drainer lists before you sign.
Yes — that's the permit drainer pattern: one signed message grants an unlimited allowance that's drained later in a separate transaction. Always read what a signature authorizes; 'UNLIMITED' anything is a red flag.
Manufactured urgency is a scam pattern, not a program feature. Real programs settle on a public cadence — Nova Points every Friday 12:00 UTC — and never need panic timing.
Keep a separate wallet for quest sites and connects. Your long-term stack should never be the wallet you 'verify' on airdrop pages — one bad approval shouldn't touch it.
Attackers seed your transaction history with lookalike addresses (matching first/last characters) hoping you'll copy the wrong one when sending. Copy from your address book, never from history.
Before you sign, Shield simulates the outcome locally and screens the request against cryptographically signed threat lists — unlimited approvals, known drainer addresses, honeypot patterns, and lookalike spoofing are flagged in plain English.