A signature records agreement to a request
A signature records agreement to a request is central to signature requests. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, a signature records agreement to a request also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.
No-gas signatures can still matter
No-gas signatures can still matter is central to signature requests. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, no-gas signatures can still matter also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.
Verify domain and readable content first
Verify domain and readable content first is central to signature requests. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, verify domain and readable content first also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.
Unknown signing requests should be declined
Unknown signing requests should be declined is central to signature requests. A normal DApp connection uses a public address and wallet signing capability; it should not require a seed phrase, private key, recovery phrase or verification code in the webpage.
Treat connection, message signing, token approval and contract transactions as separate requests. Review the domain, network, target, amount and permission scope every time instead of assuming that a connected DApp is automatically safe.
From a practical perspective, unknown signing requests should be declined also means knowing when to stop. If a page asks for wallet secrets, the request is unreadable, the active network is not the expected one, or urgency and reward claims are used to push approval, verify independently before continuing.