Coinbase Wallet

The wallet requires user confirmation for every request.

The wallet rejected all privileged methods when not connected: eth_accounts returned an empty array, and the other methods returned errors without leaking data.

The `wallet_watchAsset` method shows that the wallet automatically tracks token ownerships on the polygon network and there is no need to import USDC.e. All the other methods triggered an error or required unlock before processing them.

The wallet does not warn or reject EIP-712 signing requests with a mismatched chainId; it displays the request with chainId 1223123 and only a generic warning, allowing the user to Sign or Cancel.

The wallet rejects the `eth_sign` request and returns an error message: `Error: eth_sign method is deprecated`.

The wallet does not warn about the domain mismatch. The dApp is running on `deploy-preview-40--wallettesting.netlify.app` but the SIWE message is for `https://opensea.io`.

The wallet UI provides a way to list existing token approvals and revoke them, by selecting a token and then sending a transaction to revoke allowance.

The wallet lists connected dApps, and the disconnected dApp is unable to send RPC requests, as indicated by the error messages.

The wallet allowed switching from Polygon (0x89) to Ethereum Mainnet (0x1) without user confirmation, and no pre-approved network management was available; it only blocked switching to unrecognized chains (zkSync Era returned 4902).

The wallet displays the expected asset changes and cost before signing for both liquidity provision and swap transactions, as shown in the confirmation screens.

The wallet's approval dialog shows the spender address and the approved amount (unlimited) under 'Pre-authorize withdrawal', as well as a well-known token symbol.

Large payloads are visible and scrollable for both personal_sign and eth_signTypedData, and the verifyingContract is displayed in the EIP712Domain.

The wallet renders the EIP-712 signature request with structured, human-readable details, showing the asset changes of '-MyToken NFT' and '+0.975 WETH' rather than raw JSON.

The wallet blocks manually entered invalid-checksum addresses, but it does not warn or block when the invalid-checksum address is provided by a dApp, allowing the transaction to proceed.

The sign button is enabled even without scrolling through the entire message.

The addresses and transaction hashes are clickable links in the wallet's transaction history and transaction view, opening a block explorer.

Password is required to view both the recovery phrase and the private key.

The wallet UI includes a 'Lock wallet' button under settings.

The auto-lock configuration is set to 24 hours by default, which does not meet the acceptance criteria of auto-locking within 20 minutes.

The wallet requires a password of at least 8 characters with at least 1 number, and rejects trivial passwords like '11111111' with a 'Too easy to guess' error.

The warning text is displayed above the 'Next' button, and the user must check the box to confirm before proceeding.

The recovery phrase can be copied to the clipboard with no limited clipboard exposure, or a warning about clipboard risks.

The wallet warns or flags transactions to known malicious addresses (0x5923...9de9) both via dApp and direct UI, but does not warn, flag, or block transactions to the lookalike address (0x462A...d954) when supplied by a dApp or entered manually.

The wallet warns the user about visiting known phishing sites hyperliqdrop.com and venofinance.net.

There is no visual distinction between verified and unverified dApps on the connection request screen. Uniswap, 1inch, and the unknown dApp all show the same standard connection request screen.

No warning or indicator is present for sending to a fresh address directly through the wallet UI, or through a dApp.

The full dApp origin URL is shown in the connection dialog without truncation: flagship-web3-v1-336a757b5b637a684207a3.webflow.io

The wallet does not have an NFT section and only displays tokens, so the spam NFTs are hidden by default.

The connection dialog clearly states that the dApp will be able to see the user's wallet balance and activity, as well as send requests for transactions.