Coin98

The wallet requires explicit user confirmation for each privileged RPC request (wallet_addEthereumChain, wallet_watchAsset, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData_v4, personal_sign, eth_sendTransaction); all were rejected when the user declined, demonstrating per-request confirmation.

The wallet rejects all privileged RPC methods (eth_accounts, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData_v4, personal_sign, eth_sendTransaction) with error code 4100 before connection approval, and eth_accounts returns no account data, preventing information leaks.

The wallet requires the user to unlock it before processing every request.

The wallet displays a warning indicating that the provided chainId '1444437' does not match the active chainId '137', which satisfies the acceptance criteria.

The wallet rejected `eth_sign` requests with an error message "Error: Method not supported."

The wallet does not warn the user about the domain mismatch between the dApp origin (deploy-preview-40--wallettest) and the domain specified in the SIWE message (opensea.io).

The wallet provides a link in its 'Services' menu that directs to Coin98 Terminals, which offers functionality to list and revoke token allowances.

The wallet lists connected dApps, and after disconnecting the testing dApp, RPC requests failed as expected, demonstrating that access was successfully revoked.

The wallet prompts for confirmation before switching to zkSync Era via WalletConnect, satisfying the requirement for user confirmation before chain switch.

The wallet shows the expected inputs and outputs for both the liquidity provision and the swap before signing, displaying the token amounts (POL and UNI-V3-POS or USDC) and network fees on the transaction confirmation screen.

The wallet clearly identifies approval requests and displays the token address, spender address, and approved amount (unlimited) for both custom ERC-20 and swap dApp approvals.

The wallet displays all signing data for personal_sign and EIP-712, including the verifyingContract (shown under '3rd Party's Details'), and the payloads are scrollable and not truncated.

The wallet renders the EIP-712 signature request as raw JSON, not a structured, human-readable format as required.

The wallet blocked transactions to invalid-checksum addresses both when entered manually and when provided by a dApp; the transactions did not proceed.

The confirm button is enabled even when the message is not fully scrolled, indicating that the sign button is accessible before scrolling to the end of the content.

The wallet provides block explorer links for some identifiers but not all: in the transaction preview, only the 'From' address is linked; the 'To' address is not. In the transaction history, the transaction hash is linked, but the sender and recipient addresses are not.

Authentication is required before accessing sensitive information like seed phrases or private keys.

The wallet UI includes a manual lock button, as seen by the lock icon in the top right.

The wallet does not offer an auto-lock time setting and does not automatically lock after 20 minutes of inactivity.

The wallet enforces the use of a strong password with a minimum length of eight characters.

The wallet displays a warning message explaining the importance of keeping the seed phrase/private key secret before revealing it to the user.

The wallet allows the seed phrase to be copied to the clipboard without any warning or automatic clearing, exposing the mnemonic to clipboard-based exfiltration.

The wallet did not warn, flag, or block the transaction for the known malicious address (0x592340957eBC9e4Afb0E9Af221d06fDDDF789de9) or the lookalike address (0x8730aeb8FE951cfa6e17f82341ECD95C921FDa54), whether entered manually or supplied via dApp.

The wallet does not display a warning when attempting to connect to known phishing sites hyperliqdop.com, venofinance.net and token-2049.world, all of which are included in the MetaMask phishing list.

The wallet does not feature a verified domain indicator for well-known dApps.

The wallet does not display any warning or indicator when sending to the unknown address 0x50Bb16e48eaA265C125858926A1187D045518c71, both via dApp and manual entry.

The wallet truncates the dApp URL in the connection dialog, but expanding the view reveals the full URL.

Spam NFTs are displayed by default in the wallet.

The connection dialog clearly mentions the ability to view the user's balance and activity, as well as to request transaction approvals.