Bitget

The wallet requires explicit user confirmation before executing each dApp request; all tested methods (wallet_addEthereumChain, wallet_watchAsset, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData_v4, personal_sign, eth_sendTransaction) were rejected when the user declined the prompts.

The wallet rejected all privileged RPC requests made before the user connects, including eth_accounts (empty), eth_decrypt and eth_getEncryptionPublicKey (errors), and eth_signTypedData_v4, personal_sign, and eth_sendTransaction (rejected), with no account information leaked.

The wallet requires the user to unlock it before processing each request; all tested RPC methods were rejected while locked and no data was returned.

The wallet does not warn or reject the signing request when the chainId in the EIP-712 object differs from the wallet's active network. The signature confirmation is displayed without any warning about the chainId mismatch.

The wallet processed the eth_sign request and returned a success, contrary to acceptance criteria that requires rejection or redirection to personal_sign.

The wallet displays the SIWE request from https://opensea.io, but the request source is a netlify app. There is no warning or blocking of the signing request.

The wallet provides a tool called 'Approval Checker' that allows users to list existing token approvals and revoke them.

The wallet lists connected dApps, the user disconnects one, and the dApp can no longer send RPC requests, therefore the check is passed.

The wallet prompts the user to confirm before switching from the Ethereum network to the Polygon network.

The wallet displays the expected asset changes for both liquidity provision and swap before signing, including the output token amounts (e.g., +0.001209 USDC for the swap).

The wallet's approval dialog displays the token symbol and approved amount (unlimited), but does not include the spender address, failing to clearly show all required details.

Signing data is visible and scrollable for both structured data and large text payloads, but the verifying contract is not included within the EIP-712 object.

The wallet is rendering raw JSON for the EIP-712 signature request, instead of structured, human-readable details.

The wallet displays an "invalid address" error message when attempting to send a transaction to an address with an incorrect EIP-55 checksum.

The 'Agree' button is enabled without scrolling through the entire message, failing the acceptance criteria.

The wallet does not provide clickable block explorer links for addresses, contract addresses, or transaction hashes in the transaction preview. However, it provides a link to the blockchain explorer in the transaction history.

A password prompt before displaying the seed phrase, which fulfills the acceptance criteria.

The wallet includes a manual lock control, labelled 'Lock wallet'.

The wallet has an autolock setting, but it is configured to 30 minutes which is outside of the acceptance criteria of 20 minutes.

The wallet accepts the trivial password '11111111', and flags it as a weak password. The application should reject trivial passwords.

The wallet clearly communicates the risks of sharing the seed phrase and displays warnings to the user before revealing the secrets.

The wallet warns about the risks of copying or taking screenshots of the seed phrase. This satisfies the acceptance criteria.

The wallet blocks the known malicious address (0x592340957eBC9e4Afb0E9Af221d06fDDDF789de9) on manual entry and via dApp, and warns for the lookalike address (0x8730aeb8FE951cfa6e17f82341ECD95C921FDa54) on manual entry, but does not warn for the lookalike address when supplied by a dApp.

The wallet does not display a warning for any of the listed phishing sites.

The wallet does not highlight well-known dApps.

The wallet does not display any warning or indicator when sending to the unknown address 0x9eb91Fbc0291180088a7ff279FA7d35d26a42516, neither during the dApp-initiated confirmation nor during manual entry in the wallet UI.

The wallet truncates the dApp origin URL in the connection dialog, and the full URL cannot be revealed, failing the requirement.

The wallet is displaying multiple spam tokens by default.

The connection dialog mentions 'Querying of your information on the Ethereum network' and 'Requesting transaction authorization'.