MetaMask

The dApp requested the following RPC calls: `wallet_addEthereumChain`, `wallet_watchAsset`, `eth_decrypt`, `eth_getEncryptionPublicKey`, `eth_signTypedData*`, `personal_sign`, `eth_sendTransaction`. With the exception of `wallet_addEthereumChain` and `wallet_switchEthereumChain`, the user rejected all the requests, indicating that the user confirmation is working as intended.

The wallet correctly rejected all requests that require authorization or address access when not connected, with no information leaked.

The wallet requires users to unlock it before processing dApp requests when in a locked state.

The wallet displays an error when the chainId in the EIP-712 object does not match the active chainId of the wallet.

The wallet rejects the `eth_sign` request, as indicated by the error message 'The method "eth_sign" does not exist / is not available.'

The wallet displays a warning to the user that the site making the request is not the site they are signing into.

The wallet provides a "Spending Caps" feature, which allows users to view and revoke token approvals in MetaMask Portfolio.

The wallet lists connected dApps, and after disconnecting one, the dApp can no longer connect without reconnecting.

The wallet prompts a confirmation dialog when a dApp requests to switch to the Polygon network.

The screenshot shows the wallet displaying the expected inputs (POL, USDC) and outputs (#97572) from a Uniswap transaction before signing.

The wallet displays the token, spender and approved amount when the approval is triggered through a swap DApp. It does not show a custom ERC-20 approval.

The wallet renders large personal_sign and EIP-712 signing data in a scrollable view where the full content is accessible, and the EIP-712 verifyingContract is displayed (Seaport).

The wallet renders structured, human-readable signing details for the OpenSea Seaport EIP-712 signature request, rather than raw JSON.

The wallet does not warn the user when an address with an invalid checksum is provided, whether by a dApp or during manual transaction entry.

The confirm button is still enabled before scrolling to the end of the message.

The address, contract address, and transaction hashes are clickable and viewable on a block explorer in the wallet history but not during the send transaction flow.

The user is prompted to enter their password on the 'Reveal Secret Recovery Phrase' screen, which means authentication is required before displaying the seed phrase.

The wallet has a logout button in the settings menu that allows manual locking.

The auto-lock setting is set to 'Never', indicating the wallet does not auto-lock on inactivity.

The password field requires at least 8 characters, but it allows easy-to-guess passwords such as 11111111.

The wallet clearly communicates the risks of losing or sharing the seed phrase through a quiz and displays a warning to the user before revealing the secrets.

The wallet shows the seed phrase screen with a warning about the risk of exposing the seed phrase, but it does not display a specific warning when copying it to the clipboard, nor does it restrict copying.

The wallet correctly warns and blocks transactions to both a known malicious address and a poisoned lookalike address, covering manual UI entry and dApp requests for both.

The wallet warns the user when visiting or attempting to connect to known phishing sites such as hyper-usdt.org, master--ethereumorg.netlify.app, and revolution-coredaorg.pages.dev.

Verified dApps like Uniswap and Sushi are displayed with a green checkmark next to the URL, which distinguishes them from unverified dApps.

When sending to a fresh address, the wallet presents an 'Unknown address' indicator and prompts the user to save the address with a nickname.

The origin URL 'main--wallettesting.netlify.app' is displayed in full without truncation in the connection dialog.

The wallet successfully filters spam NFTs but it displays spam tokens, such as '69.69 ADS: POL CASINO WWW.MATICSLOT.IO' (address 0x950Ddb91842C58814ed4Ee7077Ce35632225797e) by default in the tokens list, failing to hide malicious tokens by default.

The connection dialog clearly mentions the ability to view the user's balance and activity, as well as to request transaction approvals.