The wallet provides identity and signing
The wallet provides identity and signing is central to web3 & dapps. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, the wallet provides identity and signing also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.
Verify the DApp domain first
Verify the DApp domain first is central to web3 & dapps. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, verify the dapp domain first also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.
Review signatures and approvals separately
Review signatures and approvals separately is central to web3 & dapps. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, review signatures and approvals separately also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.
Inspect connections and approvals afterward
Inspect connections and approvals afterward is central to web3 & dapps. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, inspect connections and approvals afterward also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.