DApp Connections
Safe DApp connection starts with domain verification, account scope and later permissions. A connected wallet is not proof that a site is trustworthy.
On this page
Start with the domain and source
Check domain spelling, protocol and page source before using a DApp. A lookalike site can copy the visual interface while issuing entirely different signature or approval requests.
A common mistake is to treat a normal-looking interface as proof that the underlying blockchain action is correct. Public addresses, transaction hashes, contract addresses and network parameters provide independent ways to verify what is happening.
Choose the intended account and network
Connect only the account needed for the current task and verify the required network. Do not switch to an unfamiliar network merely to make a page appear to work.
A repeatable order of checks is more reliable than memory. Review source, network, account, target and expected outcome each time so the same safety logic carries across wallets and DApps.
Review every later request
After connection, a message signature, transaction or approval is a new decision. Review the source, contract, amount and permission scope every time.
When a task involves a third-party contract, bridge, validator or web service, separate that external risk from the wallet itself. A wallet can display and sign a request, but it cannot guarantee the safety of outside code or services.
End the session and review approvals
Disconnect sessions you no longer need, but review on-chain approvals separately. Disconnecting does not automatically remove allowances already recorded on-chain.
Put this concept back into the current network, account and request type before acting. Identify what the interface is asking for, then decide whether a signature, gas payment or ongoing permission is actually required.
Practical checklist
- Confirm that “Start with the domain and source” matches the task you intend to perform
- Confirm that “Choose the intended account and network” matches the task you intend to perform
- Confirm that “Review every later request” matches the task you intend to perform
- Confirm that “End the session and review approvals” matches the task you intend to perform
Risk reminder
Seed phrases and private keys remain under the user’s control. Legitimate support should not ask for a seed phrase, private key or verification code. Review address, network and amount before transferring; blockchain transactions generally cannot be unilaterally reversed by a wallet. Third-party DApps and smart contracts carry risk, so review spender and permission scope and consider revoking unused approvals.