A user clicks what appears to be a legitimate NFT marketplace link, connects their wallet, and sees a familiar interface requesting permission to interact with a smart contract. The transaction looks standard: a token approval, a swap, or a mint operation. In the seconds before signing, most wallets show only a contract address and a function name. The actual consequence—whether the user is about to...