OneKey

The wallet requires a user confirmation to access the RPC endpoints.

The wallet correctly rejects all unauthorized requests (eth_accounts, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData_v4, personal_sign, eth_sendTransaction) with error code 4100 when not connected, and no data is leaked (eth_accounts returns empty).

The wallet requires users to unlock the wallet to process requests from dApps.

The wallet rejected the EIP-712 signing request with an error that the provided chainId (1223123) must match the active chainId (137).

The wallet does not reject eth_sign requests, it processes them successfully.

The SIWE message was signed despite the mismatch between the dApp origin and the domain specified in the SIWE object. There was no warning or blocking as required.

The wallet UI lists existing token approvals, and it allows the user to revoke them.

The wallet displays a list of connected dApps, and after disconnecting the testing dApp, subsequent RPC requests from it are rejected.

The chain was switched successfully without prompting for confirmation, which does not meet the acceptance criteria.

The wallet shows the expected inputs and outputs before signing for both the liquidity provision and the swap, including the amounts of POL and USDC.e and the Uniswap V3 Positions NFT.

The wallet clearly identifies the approval and shows the token symbol (USDC, WSRT), spender address (0x6592...), and approved amount (Unlimited) for both requests.

Large payloads are visible and scrollable for both personal_sign and eth_signTypedData. The EIP712Domain is also displayed, including the verifyingContract.

The wallet renders structured, human-readable signing details for the Opensea listing, showing the token being paid and the amount of WETH being received.

The wallet blocks the transaction or displays a checksum warning before the transaction proceeds both manually and from a dApp.

The confirm button is enabled before scrolling through the entire message, failing the acceptance criteria.

The transaction history view shows a link to the block explorer for the transaction hash. The transaction detail view does not display any links.

The application requires authentication (passcode) before displaying the seed phrase or private key.

The wallet includes a 'Lock now' button in the General section of the UI, satisfying the requirement for a manual lock control.

The auto-lock default is set to "never". Therefore, the wallet will not auto-lock on inactivity.

The 'Set passcode' button is enabled despite using '11111111' as the new password, indicating that trivial passwords are not being rejected, and the system is not enforcing strong password creation.

The wallet displays a warning to the user about the risks of sharing the recovery phrase or private key before revealing it.

The wallet prevents copying the seed phrase, satisfying the acceptance criteria.

The wallet warned about the lookalike address (0x8730aeb8FE951cfa6e17f82341ECD95C921fDa54) when entered manually, but did not warn for the known malicious address (0x592340957ebc9e4afb0e9af221d06fdddf789de9) in either manual or dApp entry, and did not warn for the lookalike address when supplied via dApp.

The wallet warns the user when visiting or connecting to known phishing sites.

Verified dApps are clearly distinguished from unknown ones by the presence of a "Verified Site" indicator and logos of listing services, while unverified dApps do not have these indicators.

The wallet shows an 'Initial transfer' indicator when sending to the fresh address 0x9eb91fbc0291180088a7ff279FA7d35d26a42516, both when the address is provided by a dApp and when entered manually.

The full dApp origin URL, "flagship-web3-v1-336a757b5b637a684207a3.webflow.io", is shown without truncation in the connection dialog.

Spam tokens are hidden under the 'Collapsed risk assets' label and spam NFTs are hidden by default.

The connection dialog clearly states that the dApp will be able to 'View your balance and activity' and 'Send approval requests', which meets the acceptance criteria.