OKX

All RPC endpoints prompted for user confirmation.

The wallet rejected all connection bypass requests before connecting, returning an empty account list for eth_accounts and errors for the remaining methods, with no information leaked.

The wallet required unlocking for all 7 RPC requests (wallet_addEthereumChain, wallet_watchAsset, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData_v4, personal_sign, eth_sendTransaction); none were processed and no data was returned while locked.

The wallet did not reject the signing request or display a warning about the chainId mismatch. The transaction was signed successfully despite the chainId mismatch.

The wallet rejects the `eth_sign` request, displaying a "risky transaction" warning and an error message indicating that the user denied the request.

The wallet does not warn about the domain mismatch between the dApp (deploy-preview-40--...) and the SIWE object (opensea.io), and allows signing of the SIWE message.

The wallet provides a built-in feature to list existing token approvals and revoke them.

The wallet rejected all connection bypass requests before connecting, returning an empty account list for eth_accounts and errors for the remaining methods, with no information leaked.

The chain was changed to Polygon Mainnet (0x89) after executing the switchEthereumChain method, without any prompt for confirmation.

The wallet shows the expected inputs and outputs (-0.000996 POL and -0.000138 USDC) from the contract interaction on Uniswap before signing.

The wallet clearly identifies the approval request, showing the token symbol (USDC.e and WSRT), the spender address (0xe592427a0aece92de3ede1f18e0157c05861564), and the unlimited approval amount.

Both `personal_sign` and `eth_signTypedData` (EIP-712) requests show full content and are scrollable. The EIP-712 data includes the `verifyingContract` field.

The signature request displays raw EIP-712 data instead of rendering structured, human-readable details as required.

The wallet allowed transactions to proceed to the confirmation screen without any checksum warning for both manually entered and dApp-provided addresses.

The 'Confirm' button is enabled without scrolling to the end of the content, failing the acceptance criteria.

The transaction hash is linked in history, but addresses are not linked when sending a transaction.

A password is required before displaying mnemonics and private keys.

The wallet UI includes a 'Lock wallet' control in the menu.

The default auto-lock is set to 2 hours, which is outside the acceptable timeframe of 20 minutes.

It is possible to set 11111111 as password. This violates the acceptance criteria, as it allows trivial passwords.

The wallet displays a warning to the user explaining the risks of exposing their seed phrase and private keys before revealing the secrets.

The wallet does not allow copying the seed phrase to clipboard, satisfying the acceptance criteria.

The wallet successfully identifies and warns against transactions to known malicious addresses (Compliance Risk), both when initiated by a dApp and when entered manually. However, the wallet does not surface any warning or flag when attempting to send a transaction to a lookalike address.

The wallet warns the user when visiting a known phishing site.

The wallet does not visibly distinguish verified dApps from unknown ones; the connection screens for Uniswap, 1inch, Sushi, and an unknown dApp are identical with no trust badge or checkmark.

The wallet shows a 'Not in address book' indicator for manual entry, but no warning or indicator when the same unknown address is provided by a dApp, failing the requirement to warn in both cases.

The dApp origin URL is fully displayed without truncation in the connection dialog.

Spam tokens and NFTs are hidden by default as the wallet does not display them initially.

The connection dialog box only states, "Allow this DApp to connect with your wallet." It does not specify the access the DApp is being granted, specifically, the ability to view the user's balance and activity, as well as to request transaction approvals.