Read this first
Safe transaction review got stricter after the ByBit/Safe incident. The point of this guide is simple: verify the transaction outside the Safe UI before signing.
Transaction verification
This guide is for reviewing and signing one Easy Track transaction:
- Remove Max-Profit bloxRoute Relay from the MEV relay list
What you need to verify
Before signing, confirm these three things:
- Safe transaction details are correct
- Correct Safe address
- Correct Easy Track factory
- Correct calldata / decoded relay data
- Transaction calldata matches the proposal
- Decode the Safe transaction data with an external decoder.
- Confirm it creates the expected Easy Track motion.
- Hardware wallet hashes match
- Calculate the transaction hashes independently.
- Compare the full Domain and Message hashes on the hardware wallet before signing.
Do not sign if anything is unclear, mismatched, or only βprobably rightβ. Ask the proposer to explain.
Step 1 of 6 β Open the Safe transaction
Progress: π¦β¬β¬β¬β¬β¬
- Go to Safe and connect your wallet.
- Open the pending transaction.
- Copy the Safe address from the top-left corner.
Expected RMC multisig:
0x98be4a407Bff0c125e25fBE9Eb1165504349c37dIf the Safe address is different, stop and ask.
Step 2 of 6 β Check the Easy Track parameters
Progress: π¦π¦β¬β¬β¬β¬
In the Safe transaction, find the Easy Track createMotion call.
Check the following:
Field | Expected value / check |
_evmScriptFactory | 0x9721c0f77E3Ea40eD592B9DCf3032DaF269c0306 |
Factory name | RemoveMEVBoostRelays |
_evmScriptCallData | Must decode to the relay that is meant to be removed |
Use the official Lido deployed contracts page to confirm the factory address:
Easy Track factories for MEV Boost relay allow-list management
Decode _evmScriptCallData
- Open the factory on Etherscan:
- Go to Read Contract.
- Paste
_evmScriptCallDataintodecodeEVMScriptCallData. - Click Query.
- Compare the decoded relay values with the forum proposal for removal:
Expected outcome: the decoded data clearly points to the relay that should be removed.
Step 3 of 6 β Copy the Safe transaction data
Progress: π¦π¦π¦β¬β¬β¬
Expand the Safe transaction details and copy the full transaction data somewhere temporary.
You will need these fields for decoding and hash calculation:
{
"to": "...",
"data": "...",
"value": "...",
"operation": "...",
"baseGas": "...",
"gasPrice": "...",
"gasToken": "...",
"nonce": "...",
"refundReceiver": "...",
"safeTxGas": "..."
}A temporary text editor or private Notion scratch page is fine. The important part is not to lose or accidentally alter any value.
Step 4 of 6 β Decode the Safe transaction data externally
Progress: π¦π¦π¦π¦β¬β¬
Now cross-check what Safe is asking you to sign.
- Check the
toaddress. - It should point to the expected Easy Track contract.
- Confirm it against the Lido deployed contracts page:
- Copy the
datavalue. - Decode it using one of these tools:
- calldata.swiss-knife.xyz/decoder β good general-purpose decoder; do not connect your wallet if prompted.
- Etherscan input data decoder β better for direct call transactions.
- rimeissner.dev transaction decoder β better for MultiSend / delegate-call transactions.
- Confirm the decoded output matches Step 2:
- Factory:
RemoveMEVBoostRelays - Factory address:
0x9721c0f77E3Ea40eD592B9DCf3032DaF269c0306 _evmScriptCallData: the same value you checked earlier
If any decoded value does not match, stop and ask.
Step 5 of 6 β Calculate the Safe hashes
Progress: π¦π¦π¦π¦π¦β¬
After the transaction parameters make sense, calculate the Safe hashes independently.
You can use either method below. The UI is easier; the script is better for offline verification.
Option A β Lido Safe hashes calculator
- Open the Lido Safe hashes UI repo:
- In Validated hashes and links, open the IPFS link.
- Enter the transaction values copied in Step 3.
- Check defaults carefully.
- Ethereum mainnet Chain ID is
1. - If this is not mainnet, use the correct network from the supported networks list:
- Click Calculate hashes.
https://github.com/lidofinance/safe-tx-hashes-ui
You should get the Domain hash and Message hash.
Some fields default to zero. If your Safe transaction has any non-zero value, enter it explicitly.
Option B β safe-tx-hashes script
Use this if you prefer local/offline verification.
- Install the script using the repo instructions:
- Open your terminal in the cloned repo.
- Run the script using the transaction values from Step 3.
Example command:
Any non-zero value must be provided explicitly. For example, if operation is 1, include --operation 1. If it is 0, the flag can be omitted.
Step 6 of 6 β Compare hashes on the hardware wallet
Progress: π¦π¦π¦π¦π¦π¦
On your hardware wallet, compare the full values:
- Domain hash
- Message hash
Compare the entire hash, not only the first and last characters. If your machine is compromised, a payload could be crafted to make partial checks misleading.
If both hashes match completely, you can sign the transaction.
Some hardware wallets show the multisig address instead of the Domain hash. If the address matches the Safe address you are signing from, that is expected because the Domain hash is derived from the multisig address.
Quick checklist
Use this as the final pre-signing check:
_evmScriptFactory is RemoveMEVBoostRelays.0x9721c0f77E3Ea40eD592B9DCf3032DaF269c0306._evmScriptCallData decodes to the relay intended for removal.to address is the expected Easy Track address.data decodes to the same Easy Track parameters.If every box is checked, sign.