txdecode

README

txdecode

Know what a transaction does before you sign it. txdecode turns an Ethereum transaction hash or raw calldata into a human-readable call tree and flags dangerous operations — unlimited approvals, setApprovalForAll, permits, ownership transfers, proxy upgrades.

Wallet pop-ups show an inscrutable blob of hex and ask you to trust it. Most drainer attacks hide behind exactly that. txdecode decodes the blob so you can read it in plain English first — and it never touches your keys.

Companion to nodrain: nodrain finds the risky approvals you already granted; txdecode tells you what a transaction will do before you grant a new one.

Features

• 🔍 Decode anything — a transaction hash (fetched over a public RPC, no API key needed) or a raw 0x calldata blob.
• 🌳 Expands batch calls — recurses into multicall, Multicall3 aggregate3/aggregate and friends, so bundled actions are laid out as a tree.
• 🚩 Flags danger — unlimited approvals, setApprovalForAll, gasless permit, transferOwnership, proxy upgradeTo — with a one-line verdict.
• 🎯 Accurate, with graceful fallback — verified contract ABIs via Etherscan (optional key) → a bundled ABI of well-known functions → the 4byte directory, de-spammed by preferring the oldest registration.
• 🛡️ Hardened output — every untrusted string (signatures, param names) is sanitised so a hostile contract can't corrupt your terminal.
• 📦 Single static binary, --json for scripts, read-only by design.

Install

# Homebrew (the tap is shared with nodrain; trust it once)
brew tap tienkane/tap
brew trust tienkane/tap
brew install --cask txdecode

# Go
go install github.com/tienkane/txdecode@latest

# Or grab a prebuilt binary: https://github.com/tienkane/txdecode/releases

Usage

# Decode a transaction by hash (zero config)
txdecode 0x2f1c…  --chain ethereum

# Decode raw calldata (e.g. copied from a wallet confirmation)
txdecode 0x095ea7b3000000000000000000000000…

# Give it the target contract to use the verified ABI (exact param names)
txdecode --to 0xA0b8…eB48 0x095ea7b3…

# Machine-readable
txdecode --json 0x2f1c… | jq '.call.risks'

# Sharper decoding with a free Etherscan key (optional)
export ETHERSCAN_API_KEY=YOUR_KEY
txdecode 0x2f1c… --chain arbitrum

Flags

Flag	Env	Default	Description
--chain		ethereum	Chain to use (ethereum, arbitrum, polygon, base, optimism, bsc)
--to			Target contract for raw-calldata mode (verified-ABI lookup)
--etherscan-key	ETHERSCAN_API_KEY		Optional — upgrades decoding to verified ABIs
--rpc	TXDECODE_RPC_URL	public RPC	RPC endpoint to fetch transactions
--json		false	JSON output
--calldata		false	Treat input as calldata even if it looks like a hash

How it works

input ─▶ tx hash?  ─yes─▶ fetch tx over RPC → (to, calldata)
       └ raw calldata ──▶ (to from --to, calldata)
                              │
                              ▼
            resolve selector: verified ABI → bundled ABI → 4byte
                              │
                              ▼
            decode args · flag risks · recurse batch wrappers
                              │
                              ▼
                  colourised tree  ·  --json

Building from source

git clone https://github.com/tienkane/txdecode
cd txdecode
go build .        # ./txdecode
go test ./...

Requires Go 1.25+.

License

MIT.

Documentation

Overview

Command txdecode decodes an Ethereum transaction's calldata into a human-readable call tree and flags dangerous operations (unlimited approvals, setApprovalForAll, permits, ownership transfers, proxy upgrades). Give it a transaction hash or a raw 0x calldata blob. It is read-only and never signs.