Exodus

The wallet auto-approved `wallet_watchAsset` without requiring confirmation, although the custom token was not added to the asset list. Other sensitive requests required user confirmation and were rejected.

The wallet blocked all privileged RPC methods before connection: eth_accounts returned an empty array, and the remaining methods returned authorization errors (4100/-32600), with no information leaked.

The wallet processed the `wallet_watchAsset` request and returned `true` while locked, without requiring the wallet to be unlocked, although the custom ERC-20 token was not added to the asset list.

The wallet rejects signing requests when the chainId supplied in the typed data does not match the active chainId.

The `eth_sign` request resulted in a "Method not found" error, meaning the wallet rejects `eth_sign` requests, which satisfies the acceptance criteria.

The wallet did not warn the user about the domain mismatch and signed the SIWE message.

The wallet does not offer token allowance revocation within the app, nor does it provide a third-party external link for this purpose.

The wallet lists connected dApps. After disconnecting netlify.app, RPC requests from it failed, indicating that access was successfully revoked.

The chain was changed to Polygon (0x89) without a confirmation prompt.

The wallet shows the expected inputs and outputs from the execution of swap transactions before signing.

The wallet identifies the request as an approval and shows the token symbol and spender address, but does not display the approved amount, which is required for a clear approval dialog.

The signing data is visible, scrollable, and not truncated, including the verifyingContract for EIP-712.

The wallet is rendering the signature request as raw JSON rather than structured, human-readable detail.

The wallet correctly blocks manually entered addresses with invalid EIP-55 checksums, showing 'Invalid POL address.' However, when the same address is provided via a dApp, the wallet does not show a checksum warning or block the transaction for checksum reasons.

The sign button is accessible even though the user has not scrolled to the end of the message.

Addresses and transaction IDs are displayed as links in transaction history, but the transaction screen does not show any clickable links.

Secret recovery phrase screen requires a password before viewing the secret phrase.

The wallet includes a "Lock Wallet" button at the bottom of the Security settings screen.

The auto-lock setting is present and set to 60 minutes by default, thus, the wallet does not auto-lock within 20 minutes as required.

The wallet enforces at least an eight characters long password, and it does not allow trivial passwords.

The seed phrase reveal screen clearly communicates the risks of sharing the secret phrase and displays a warning to the user before revealing the secrets.

The warning message in the screenshot indicates that the wallet warns the user about the risks of saving the seed phrase in a screenshot and prevents user from copying them to the clipboard.

The wallet warns for the known malicious address when supplied via dApp, but does not warn for the poisoned lookalike address in either the dApp or manual entry; manual entries only show generic notices (e.g., fee > send amount) that are not address-specific.

The wallet warns the user when attempting to connect to known phishing sites.

Verified and unverified dApps are indistinguishable in the connection request screens. All connection requests display an app icon, name, URL, and list of permissions, with no indication of trust or verification status.

The wallet fails to warn about the unknown address when sending via dApp; a notice appears in the direct send flow, but it is not explicitly identified as an unknown-address warning.

The dApp origin URL is displayed in full without truncation in the connection dialog for both safe and unsafe connections.

The wallet successfully filters spam tokens, but displays spam NFTs by default; the EVMHUB VOUCHER NFT (contract 0x77A81983...6fD6433BbB) appears in the default gallery despite a banner indicating spam NFTs are hidden.

The connection dialog mentions the ability to view the user's balance and activity, as well as request transaction approvals.