NuFi

The wallet requires user confirmation before accessing RPC endpoints.

The test dApp correctly rejects the requests without a connected wallet. No information is leaked during the process.

The wallet requires users to unlock it before processing requests from dApps.

The wallet doesn't refuse to sign an EIP712 object with a chainId that does not match the currently active chain.

The wallet rejects the `eth_sign` request, returning an "Unsupported method" error, which meets the acceptance criteria.

The wallet does not display any warning or block the signing request when the dApp origin differs from the domain specified in the SIWE object. The origin is `https://deploy-preview-40--wallettesting.netlify.app` and the SIWE domain is `https://opensea.io`.

The wallet does not offer any built-in or 3rd party token approval/revocation features.

The wallet lists connected dApps. After disconnecting, the dApp receives errors when sending RPC requests, indicating access revocation is working.

The wallet prompts the user to confirm before switching to the Polygon network.

The wallet displays simulated transaction effects before signing for both the liquidity provision and the swap, showing expected token movements (e.g., POL spent, USDC received).

The wallet clearly displays the token (POL) and the approved amount ($1,040,970,882,243,4) for the ERC-20 approve transaction, but it does not show the spender address.

The wallet displays full messages in `personal_sign` requests, but doesn't show the verifying contract within the EIP-712 object.

The wallet renders raw data instead of structured, human-readable signing details, failing the check's acceptance criteria.

The wallet correctly blocks transactions to addresses with invalid EIP-55 checksums both when the address is manually entered (showing an 'Invalid address' error) and when provided by a dApp (showing a 'bad address checksum' error and preventing signing).

The 'Sign' button is hidden until the user scrolls to the end of the content.

The transaction preview and history views display addresses and transaction hashes as links to a block explorer.

Authentication is required before displaying the recovery phrase.

The wallet includes a manual lock control, named 'Logout wallet'.

The wallet has an auto-lock setting, but the default value is 1 hour, which does not meet the acceptance criteria of auto-locking within 20 minutes.

The password field accepted '11111111' as a valid password, failing the check which requires at least an 8 character long password and does not allow trivial passwords.

The 'Reveal Secret' screen clearly warns the user about the risks of sharing their recovery phrase, including potential fund theft, and emphasizes the need for privacy.

The mnemonic phrase cannot be copied, satisfying the requirement to prevent clipboard exposure.

The wallet warned about the known malicious address when initiated via a dApp, but did not warn when it was entered manually (0x592340957eBC9e4Afb0E9Af221d06fDDF789de9). It also did not flag the lookalike address (0x8730aeb8FE951cfa6e17f82341ECD95C921FDa54) in either manual or dApp transaction attempts.

The wallet displays a warning message when attempting to connect to venofinance.net, which is on the MetaMask phishing list.

All dApps show the same screen with an icon and name. There is no distinction between known and unknown dApps.

The wallet does not show any warning or indicator for unknown addresses when sending a transaction to a fresh address.

The full dApp origin URL is shown without truncation in the connection dialog.

The wallet displays spam tokens by default; the asset list shows multiple spam tokens (e.g., 'Ads: POL C...', 'DSC', 'GIC', 'IDO') with N/A values. While spam NFTs are hidden after being flagged, token filtering is absent.

The connection dialog does not describe what access the dApp is being granted. It does not mention the ability to view the user's balance and activity, or the ability to request transaction approvals.