Signature Requests

Connection is not authorization

A DApp connection creates a communication channel between a site and a wallet. It does not automatically authorize assets or make later signature requests safe. In the context of Signature Requests, the practical goal is to understand what the wallet is showing, what the network is recording, and which details must be verified before you approve an action.

A useful check is to separate interface information from on-chain facts. Review the active network, address, transaction hash, contract or permission scope as relevant, and avoid assuming that a familiar symbol or screen guarantees the intended result.

Read every signature request

Message signatures, transaction signatures and token approvals have different consequences. Before confirming, review the requester, network, amount, contract and permission scope. In the context of Signature Requests, the practical goal is to understand what the wallet is showing, what the network is recording, and which details must be verified before you approve an action.

A useful check is to separate interface information from on-chain facts. Review the active network, address, transaction hash, contract or permission scope as relevant, and avoid assuming that a familiar symbol or screen guarantees the intended result.

Practical verification points

Token approvals and contract permissions

Third-party smart contracts may carry code, permission or governance risk. After use, disconnect sessions you no longer need and review persistent approvals. In the context of Signature Requests, the practical goal is to understand what the wallet is showing, what the network is recording, and which details must be verified before you approve an action.

A useful check is to separate interface information from on-chain facts. Review the active network, address, transaction hash, contract or permission scope as relevant, and avoid assuming that a familiar symbol or screen guarantees the intended result. Plain message signatures may support login or address-control proofs; structured-data signatures can contain more complex permissions; transaction signatures authorize executable on-chain actions. The word “sign” alone is not enough to judge risk—read the exact request.

Clean up permissions after use

A DApp connection creates a communication channel between a site and a wallet. It does not automatically authorize assets or make later signature requests safe. In the context of Signature Requests, the practical goal is to understand what the wallet is showing, what the network is recording, and which details must be verified before you approve an action.

A useful check is to separate interface information from on-chain facts. Review the active network, address, transaction hash, contract or permission scope as relevant, and avoid assuming that a familiar symbol or screen guarantees the intended result.

• Verify the active network and destination before confirming.
• Treat seed phrases and private keys as secret credentials.
• Review DApp, signature and approval requests independently.