Ownership and visual metadata are different
Ownership and visual metadata are different is central to nft basics. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, ownership and visual metadata are different also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.
Unexpected NFTs require no action
Unexpected NFTs require no action is central to nft basics. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, unexpected nfts require no action also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.
Verify contract and token ID before transfer
Verify contract and token ID before transfer is central to nft basics. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, verify contract and token id before transfer also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.
Watch for look-alike collections
Watch for look-alike collections is central to nft basics. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, watch for look-alike collections also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.