Brave

The wallet requires user confirmation for all the RPC endpoints.

The wallet rejects all dApp requests to privileged RPC methods with an unauthorized error (code 4100) when the wallet is not connected, and no account information is leaked; eth_accounts returns an empty array.

The wallet did not process any of the six RPC requests while locked: wallet_addEthereumChain and wallet_watchAsset returned no response, and eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData_v4, personal_sign, and eth_sendTransaction all returned error code 4100 (unauthorized). No sensitive data was returned.

The wallet signed the EIP-712 object even though the chainId was different from the active network, without displaying a warning or rejecting the request.

The wallet redirected the `eth_sign` request to `personal_sign`, and indicated that the wallet used personal_sign, converted to bytes.

The wallet detected the domain mismatch between the dApp and the SIWE object and blocked the signing request.

The wallet does not offer the ability to list and revoke token approvals, via in-app functionality or links to external dApps.

The wallet lists connected dApps and revoking access prevents further RPC requests from the disconnected dApp.

The wallet prompts for user confirmation before switching the network, as required.

The wallet only shows the amount of MATIC being sent, but do not show the expected outputs from the execution of the transaction before signing.

The wallet clearly identifies the approval request and displays the token symbol/address, spender address, and approved amount for both the known token (USDC) and the custom ERC-20 (WSRT).

Large payloads for both `personal_sign` and `eth_signTypedData` are fully scrollable, and the `EIP712Domain`, including the `verifyingContract`.

The wallet renders raw JSON for the Seaport EIP-712 signature request, instead of structured human-readable details.

The wallet correctly identifies and warns the user about an incorrect EIP-55 checksum for manual transactions. For dApp transactions, the wallet blocks the transaction when an invalid address (due to incorrect checksum) is provided.

The Sign button is enabled before the user has scrolled through all the content, failing the acceptance criteria.

Addresses, contract addresses and transaction hashes are clickable and open a block explorer both when attempting to send a transaction and querying the wallet history.

A password is required before the user can continue to back up their wallet.

The wallet UI contains a "Lock wallet" button in the portfolio menu.

The wallet has an auto-lock setting that defaults to 5 minutes, as indicated by the screenshot. The wallet auto-locks after inactivity within 20 minutes.

The wallet allows '11111111' as a valid password, which is considered a trivial password. The application should prevent users from using such passwords.

The risks of sharing the recovery phrase are clearly communicated before revealing it.

The wallet allows copying mnemonics to the clipboard but these secrets are present for less than one minute (five seconds).

The wallet did not warn, flag, or block transactions to the known malicious address 0x592340957eBC9e4Afb0E9A221d06fDDF789de9 or the lookalike address 0x8730aeb8FE951cfa6e17f82341ECD95C921FDa54, whether entered manually or via the dApp.

The wallet does not display any phishing warning for the listed URLs. It only displays 'Make sure you trust this site.'

Verified dApps show the 'Verified by DappRadar' badge on the connection request screen, and unknown dApps don't show the badge.

The wallet does not display any warning or indicator when sending to an unknown address, both when the address is provided by a dApp and when entered manually.

The full dApp origin URL is shown without truncation.

Spam tokens and NFTs are displayed by default in the portfolio view.

The connection dialog clearly describes the permissions being granted, including the ability to check wallet balance and activity and request transaction approvals, satisfying the acceptance criteria.