Verify site identity before connecting
Check domain spelling, link source and the exact feature you intend to use so a wallet connection is not initiated on an imitation page or unexplained redirect. A DApp connection should begin with the domain and request source, then distinguish account connection, message signatures, transaction signatures and token approvals. For “Verify site identity before connecting,” first identify whether the relevant fact belongs to the local wallet interface, the selected network, or a contract permission. That distinction prevents an interface message from being mistaken for a final on-chain result.
Before confirming, review the domain, account, network, contract or recipient and any approval amount. If the purpose of the request cannot be explained, declining it is safer than treating connection as ongoing consent. In the context of “Verify site identity before connecting,” use a consistent order: establish the account and network, inspect the specific address, contract or request parameters, and only then authorize an action that can move assets or create permissions. Before confirming, review the domain, account, network, contract or recipient and any approval amount. If the purpose of the request cannot be explained, declining it is safer than treating connection as ongoing consent.
Within “Verify site identity before connecting,” a connection is only a session and does not pre-authorize asset actions. A message signature may prove account control, a transaction signature can change on-chain state, and a token approval can create persistent contract permissions; each deserves its own review.
- Verify the DApp domain and request source
- Distinguish connection, signing, transactions and approvals
- Inspect the contract or spender and permission scope
- Disconnect and review permissions when no longer needed
Common mistakes and a better sequence
If “Verify site identity before connecting” behaves differently from expected, record the active network, account, requester and any transaction hash, then eliminate possible causes one at a time. Do not keep signing, approving or sending assets merely to repair an issue that has not yet been identified.
What a connection request can include
A DApp may ask to view an account address, current network or create a session; these requests are different from private-key access and should never require a seed phrase or verification code. A DApp connection should begin with the domain and request source, then distinguish account connection, message signatures, transaction signatures and token approvals. For “What a connection request can include,” first identify whether the relevant fact belongs to the local wallet interface, the selected network, or a contract permission. That distinction prevents an interface message from being mistaken for a final on-chain result.
When an interaction is finished, disconnect sessions that are no longer useful and review persistent approvals periodically. Revoking an old approval cannot undo a past transaction, but it can remove an unnecessary future permission. In the context of “What a connection request can include,” use a consistent order: establish the account and network, inspect the specific address, contract or request parameters, and only then authorize an action that can move assets or create permissions. When an interaction is finished, disconnect sessions that are no longer useful and review persistent approvals periodically. Revoking an old approval cannot undo a past transaction, but it can remove an unnecessary future permission.
Within “What a connection request can include,” a connection is only a session and does not pre-authorize asset actions. A message signature may prove account control, a transaction signature can change on-chain state, and a token approval can create persistent contract permissions; each deserves its own review.
- Verify the DApp domain and request source
- Distinguish connection, signing, transactions and approvals
- Inspect the contract or spender and permission scope
- Disconnect and review permissions when no longer needed
How to verify the result
If “What a connection request can include” behaves differently from expected, record the active network, account, requester and any transaction hash, then eliminate possible causes one at a time. Do not keep signing, approving or sending assets merely to repair an issue that has not yet been identified.
Continue reviewing every later request
Message signatures, transaction signatures and approvals have separate meanings, and a previous connection is not a reason to skip review. A DApp connection should begin with the domain and request source, then distinguish account connection, message signatures, transaction signatures and token approvals. For “Continue reviewing every later request,” first identify whether the relevant fact belongs to the local wallet interface, the selected network, or a contract permission. That distinction prevents an interface message from being mistaken for a final on-chain result.
When an interaction is finished, disconnect sessions that are no longer useful and review persistent approvals periodically. Revoking an old approval cannot undo a past transaction, but it can remove an unnecessary future permission. In the context of “Continue reviewing every later request,” use a consistent order: establish the account and network, inspect the specific address, contract or request parameters, and only then authorize an action that can move assets or create permissions. DApp requests should be separated into account connection, message signing, transaction submission and token approval. They may appear consecutively, but their permissions and on-chain effects are different.
Within “Continue reviewing every later request,” a connection is only a session and does not pre-authorize asset actions. A message signature may prove account control, a transaction signature can change on-chain state, and a token approval can create persistent contract permissions; each deserves its own review.
- Verify the DApp domain and request source
- Distinguish connection, signing, transactions and approvals
- Inspect the contract or spender and permission scope
- Disconnect and review permissions when no longer needed
How to verify the result
If “Continue reviewing every later request” behaves differently from expected, record the active network, account, requester and any transaction hash, then eliminate possible causes one at a time. Do not keep signing, approving or sending assets merely to repair an issue that has not yet been identified.
Disconnect and review permissions
When finished, disconnect the session and inspect remaining token approvals; on-chain permissions commonly need a separate revocation action. A DApp connection should begin with the domain and request source, then distinguish account connection, message signatures, transaction signatures and token approvals. For “Disconnect and review permissions,” first identify whether the relevant fact belongs to the local wallet interface, the selected network, or a contract permission. That distinction prevents an interface message from being mistaken for a final on-chain result.
When an interaction is finished, disconnect sessions that are no longer useful and review persistent approvals periodically. Revoking an old approval cannot undo a past transaction, but it can remove an unnecessary future permission. In the context of “Disconnect and review permissions,” use a consistent order: establish the account and network, inspect the specific address, contract or request parameters, and only then authorize an action that can move assets or create permissions. DApp requests should be separated into account connection, message signing, transaction submission and token approval. They may appear consecutively, but their permissions and on-chain effects are different.
Within “Disconnect and review permissions,” a connection is only a session and does not pre-authorize asset actions. A message signature may prove account control, a transaction signature can change on-chain state, and a token approval can create persistent contract permissions; each deserves its own review.
- Verify the DApp domain and request source
- Distinguish connection, signing, transactions and approvals
- Inspect the contract or spender and permission scope
- Disconnect and review permissions when no longer needed
A pre-confirmation review
If “Disconnect and review permissions” behaves differently from expected, record the active network, account, requester and any transaction hash, then eliminate possible causes one at a time. Do not keep signing, approving or sending assets merely to repair an issue that has not yet been identified.