How calldata is built
The first four bytes are the selector: the first 4 bytes of the Keccak-256 hash of the function signature. transfer(address,uint256) becomes a9059cbb, approve(address,uint256) becomes 095ea7b3. After that come the arguments in ABI encoding, each padded to 32 bytes: an address takes the last 20 bytes of its word, a number is a 256-bit unsigned integer, a dynamic value such as bytes[] is stored as an offset to where its length and contents begin.
Token amounts are raw integers without decimals. 25000000 for USDT on Ethereum means 25 USDT because the token has 6 decimals; the same number for a token with 18 decimals is a tiny fraction. The token itself is the contract you are calling โ the 'to' field of the transaction โ not a parameter.
calldata = selector(4 bytes) โ arg1(32 bytes) โ arg2(32 bytes) โ โฆ
selector = keccak256("approve(address,uint256)")[0..4] = 0x095ea7b3Calls that deserve a second look
- approve with an amount of 2ยฒโตโถโ1 (shown as ffffโฆffff) โ an unlimited allowance. The spender can take your whole balance of that token at any time until you revoke it.
- setApprovalForAll(operator, true) โ gives the operator every NFT of the collection. Marketplaces ask for it when you list; a random site asking for it is the classic NFT drainer.
- permit(owner, spender, value, deadline, v, r, s) โ puts an off-chain signature on-chain. The approval was granted when you signed a message, often earlier and elsewhere.
- transferFrom(from, to, amount) โ moves tokens out of 'from' using an existing allowance. If 'from' is your address and you did not initiate a transfer, stop.
- multicall(bytes[]) โ a batch. Routers use it legitimately for swaps; every call inside is decoded separately here.
Where to find the input data
Most wallets show it on the confirmation screen under a Data, Hex or Details tab. On Etherscan-type explorers it is the Input Data field of a transaction; switch the view to Original to copy the hex. Hardware wallets show decoded fields for supported contracts and a hash for unknown ones โ if you see only a hash, blind signing is on and you are trusting the computer screen.
The tool does not need anything secret and never contacts a node: it reads the hex you paste. An unknown selector is not proof of danger, but it is a reason to read the contract's verified source before signing.
Frequently asked questions
+What does an unlimited approval mean?
The contract can transfer any amount of that token from your wallet, now and in the future, without asking again. Revoke allowances you no longer need with your wallet or a revoke tool.
+Is approve(spender, 0) dangerous?
No. Setting the allowance to zero revokes it. Check that the token and the spender are the ones you want to revoke.
+Why is the ETH value not shown?
The native coin amount is a separate field of the transaction ('value'). Calldata only describes the contract function and its arguments.
+The selector is unknown. Is it a scam?
Not necessarily: there are millions of functions. Open the contract on the explorer, check that it is verified and read what the function does, or do not sign.
+Can I paste a transaction hash instead?
No โ the hash only identifies the transaction. Open it in the explorer and copy the Input Data hex.
Calculations run entirely in your browser; nothing you type is sent to KOT.CASH. Results are estimates for information only and are not financial, tax or legal advice.