Binance

The wallet requires explicit user confirmation for all supported privileged RPC methods; the two unsupported methods (eth_decrypt and eth_getEncryptionPublicKey) returned errors without confirmation, which poses no risk.

The wallet correctly rejects all RPC requests (eth_accounts, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData_v4, personal_sign, eth_sendTransaction) without prior connection, and no information is leaked.

The wallet requires users to unlock it before processing dApp requests when in a locked state.

The wallet displays a warning message indicating that the chain ID of the signature does not match the currently connected chain (Polygon) and identifies a risky signature.

The wallet rejected the `eth_sign` request, responding with 'Error: method not supported'.

The wallet does not warn or block the signing request, even though the dApp origin (deploy-preview-40--wallettesting.netlify.app) differs from the domain specified in the SIWE object (https://opensea.io).

The wallet provides a way to list existing token approvals and revoke them.

The wallet lists connected dApps, and after disconnecting the testing dApp, RPC requests from it are rejected.

The wallet does not prompt for confirmation when switching networks, nor does it allow users to manage pre-approved networks to limit switching. The `switchEthereumChain` request executes without any user interaction.

The wallet correctly displays simulated expected inputs and outputs for both the liquidity provision (e.g., -0.01 POL, +1 UNI-V3-POS) and the swap (e.g., -0.01 POL, +0.001215 USDC.e) before signing.

The wallet clearly identifies ERC-20 approval requests and displays the token symbol or address, the spender address, and the approved amount.

All the contents of both the personal_sign and eth_signTypedData requests are visible and scrollable, including the verifyingContract from the EIP712Domain.

The wallet displays raw JSON for the EIP-712 signature request, failing to render structured, human-readable signing details as required.

The wallet allowed a transaction to both, a manually entered address and through the dApp, with an invalid EIP-55 checksum (0xA62A0d4fE4C2b10aadFBD4628f697d09a76Cd954) without displaying any checksum warning; the transaction was submitted successfully.

The confirm button is active without scrolling through the entire message. This is the case in both the eth_signTypedData_v4 and personal_sign screens.

The wallet provides a block explorer link for the transaction hash in the transaction history, but no clickable explorer links for addresses or contract addresses in either the transaction preview or the history.

A password prompt is displayed before revealing the seed phrase/private key, confirming that authentication is required.

A "Lock Wallet" button is present within the settings screen.

The screen lock settings do not meet the acceptance criteria, as the lowest configurable time is 5 minutes, and the wallet sets it to 2 hours as default. This means the wallet will not auto-lock after inactivity within 20 minutes.

The wallet allows an 8 character long, trivial password like '11111111'.

The wallet displays a warning to the user before revealing the seed phrase or private key. The risks of sharing the secrets are clearly communicated.

The wallet prevents copying the seed phrase to the clipboard.

The wallet flags known malicious addresses when entered manually and via a dApp, and flags lookalike addresses when entered manually, but it does not flag a lookalike address supplied by a dApp.

The wallet warns the user when attempting to connect to a known phishing site.

All three dApps (Uniswap, 1inch, and Sushi) look the same, so the UI does not visually distinguish verified dApps from unknown ones.

The wallet displays a warning for new addresses when sending directly through the UI. However, no warning or indicator is shown when initiating a transaction to a new address via a dApp.

The full dApp origin URL is shown in the connection dialog without truncation.

The wallet displays only standard tokens and excludes spam tokens. NFTs are not displayed.

The wallet's dApp connection dialog does not disclose access to the user's balance, activity, or ability to request transaction approvals; it only states 'Request to Connect Your Wallet'.