Enkrypt

Each request requires explicit user confirmation before execution.

The wallet returned data for eth_getEncryptionPublicKey, eth_signTypedData_v4, personal_sign, and eth_sendTransaction without requiring connection approval, leaking account-related information.

The wallet requires user to unlock the wallet before processing each request.

The wallet rejects EIP-712 signing requests when the chainId does not match the active network, returning error -32603: "Provided chainId 1223123 must match the active chainId 137".

The wallet successfully redirected the `eth_sign` request to `personal_sign`.

The wallet did not warn the user or block the signing request despite a clear mismatch between the dApp origin (wallettesting.netlify.app) and the domain specified in the SIWE message (opensea.io).

The wallet lacks a built-in token approval management feature in Settings and General, and the DApps tab does not link to an external token approval manager, so users cannot list or revoke token approvals.

The wallet does not provide a list of connected dApps and only allows disconnection from the currently active dApp if the tab is open. If disconnected from the dapp all rpc endpoints are ok.

The wallet executed the `wallet_switchEthereumChain` RPC request and switched to zkSync Era Mainnet without displaying a confirmation prompt, allowing chain switching without user confirmation.

The wallet does not display a simulation of expected inputs and outputs for either the swap or liquidity provision; it only shows a standard confirmation screen with the amount of POL being sent.

The approval shows the token and amount, but the contract address is only available in the hidden data hex.

The wallet correctly displays large payloads for `personal_sign` and `eth_signTypedData`, allowing all content to be visible and scrollable. For EIP-712, the `EIP712Domain` including `verifyingContract` is clearly displayed.

The wallet displays plain data instead of parsing the EIP-712 object.

The wallet correctly detects invalid EIP-55 checksums and blocks the transaction for both manually entered (0x02970EA171A97EB0d627CB7EC9ABaC308253C716) and dApp-provided addresses, displaying a checksum error and disabling the Send button.

The wallet allows signing of `eth_signTypedData` and `personal_sign` messages without requiring the user to scroll to the end of the message content. The "Sign" button is enabled even when the full message is not visible.

The wallet provides clickable links to block explorers in the transaction history, but the transaction preview screen does not offer any clickable links to a block explorer.

The wallet requires password authentication before displaying the recovery phrase.

The wallet UI includes a 'Lock Enkrypt' option within the main menu, providing a manual lock control as required.

The wallet settings do not display an auto-lock configuration, but the wallet locks automatically within 20 minutes of inactivity.

The system prevents the use of the trivial 8-character password '12345678', indicating it does not allow trivial passwords and enforces a stronger password policy by disabling the 'Next' button.

The wallet clearly displays a warning about the risks of sharing the recovery phrase.

The wallet prevents copying the mnemonic to the clipboard.

The wallet does not warn, flag, or block transactions to either the known malicious address (0x592348957e8C3e4Af1b8E9A7221d86f00Df789de9) or the poisoned lookalike address (0x8730aeab8FE951cFa6e17F82341EC095C921Fa54) when entered manually or supplied by a dApp, allowing both transactions to proceed without any alerts.

The wallet did not display any warnings or prevent the user from attempting to connect to the provided sites, indicating a lack of phishing protection for known malicious domains.

The wallet does not distinguish between well-known, verified dApps and unknown ones.

The wallet displays no warning or indicator for the unknown/fresh address in either the dApp-provided path or the manual-entry path.

The connection dialog correctly displays the full dApp origin URL without any truncation, meeting the specified acceptance criteria.

The wallet successfully filtered out spam NFTs, but displays spam tokens by default in the Assets tab, including !FYDE, GIC, foxytoken, zkSwapVIP, and Gara the Clone, all with $0.00 value.

The connection dialog describes the dApp's ability to view the wallet address, balance, and past activity/transactions, but it does not explicitly mention the ability to request transaction approvals.