Wallet safety guide / Before you sign10 min read • Reviewed 2 Aug 2026
Wallet signatures, token approvals, and drainers
A wallet pop-up is an authorization request, not a routine cookie notice. Learn the difference between connecting, transacting, approving and signing so a polished interface does not make the decision for you.
Connection and authorization are different
Connecting commonly shares a selected public address with a site. The consequential step is what follows: a transaction, allowance or signature may authorize a contract, order or asset movement. Read each request independently instead of trusting the previous screen.
Know the request in front of you
Lets a site see the selected public address. Connection alone normally does not give the site your private key, but it links the address to the session.
Requests an on-chain action such as sending an asset, approving a contract or calling a smart contract. Review network, destination, value and data.
Gives a spender contract permission to transfer up to an allowance. The allowance can remain after you leave the site.
Proves control or authorizes structured data. Some signatures are login-only; others can support permits, listings or orders.
Asks the wallet to change chains. A familiar address on another network does not make the contract or asset equivalent.
Not a normal dapp permission. Stop immediately; anyone obtaining the secret may control the derived accounts.
Allowances can outlive the session
Fungible-token approvals commonly authorize a spender contract to move tokens up to a limit. Closing the tab or disconnecting the site does not necessarily cancel that on-chain allowance. Prefer a scoped amount when practical and periodically review active permissions.
Revocation is itself an on-chain transaction and normally requires a network fee. It reduces future authority after confirmation; it does not reverse an earlier transfer or make a compromised seed safe.
A signature can carry instructions
Some messages simply prove account control. Structured signatures can also authorize permits, orders or listings that another party later submits. Reject requests containing an unexpected spender, deadline, nonce, asset or domain, and do not assume “no gas” means “no risk.”
Before every signature
- I opened the service independently and verified the exact domain.
- I know which account and network are selected.
- I can explain why this request is needed for the action I initiated.
- I reviewed the spender, destination, asset, amount or allowance where shown.
- I rejected blind or unreadable requests that I cannot independently verify.
- I am using a separate low-value interaction wallet when the application is new or experimental.
If you signed something suspicious
Stop interacting with the site. Use an independently verified tool or wallet interface to review and revoke relevant allowances, move remaining assets when the wallet provider recommends it, preserve the domain and transaction evidence, and treat any exposed recovery phrase or private key as a full wallet compromise.
Check the source