Phantom

The wallet required explicit user confirmation for eth_signTypedData_v4, personal_sign, and eth_sendTransaction (all rejected by the tester). The other endpoints returned errors without prompting, indicating they are unsupported and were not executed, so no privileged operation occurred without user confirmation.

The wallet returned no account information and rejected all privileged RPC requests before any connection was established, preventing information leakage.

The wallet requires the user to unlock it before processing each request.

The wallet displays a warning message and prevents the user from signing a message that is not intended for the network the user is currently connected to.

The wallet rejected the eth_sign request as expected.

The wallet successfully identified and warned the user about the SIWE message origin mismatch, indicating the sign-in request as invalid when the dApp origin differed from the SIWE domain.

The wallet does not provide a built-in or third-party option to revoke token approvals.

The wallet lists connected dApps and after disconnecting the testing dApp, subsequent RPC requests (eth_accounts and wallet_getPermissions) return empty, confirming access revocation.

The chain was changed to Polygon Mainnet (0x89) and the `switchEthereumChain` request executed successfully without any confirmation prompt.

The wallet displays the expected inputs and outputs before signing for both the liquidity provision (spending POL, receiving Uniswap V3 Positions NFT) and the swap (spending POL, receiving USDC.e).

The wallet clearly displays the approval request, including the token symbol (USDC.e and WSRT), the spender address (0xe592...1564), and the approved amount (any amount), satisfying the check criteria.

The large payload for both personal_sign and eth_signTypedData is visible and scrollable, and the EIP712Domain including verifyingContract is also displayed.

The wallet renders structured, human-readable signing details rather than raw JSON for ERC20 Permit or Opensea listing.

The wallet correctly identifies and blocks transactions to addresses with incorrect EIP-55 checksums, both during manual input and when initiated from a dApp.

The confirm button is enabled before scrolling to the end of the message, failing the acceptance criteria.

Addresses are clickable links to a block explorer both when attempting to send a transaction and when querying the wallet history.

Authentication is required before displaying the recovery phrase.

The wallet includes a manual lock control labelled 'Lock Wallet' at the bottom of the settings screen.

The wallet has an auto-lock configuration in settings and it auto-locks by default after 15 minutes of inactivity.

The password "11111111" was accepted and classified as a 'Medium' password, failing the check for trivial password rejection.

The risks of sharing the recovery phrase are clearly communicated, including the potential for permanent loss of funds.

The seed phrase screen does not allow copying of the phrase, which satisfies the acceptance criteria.

The wallet neither warns, flags, nor blocks the transaction for neither the malicious or poisoned/lookalike addresses.

The wallet does not display a warning when connecting to known phishing sites (hyperliqdrop.com, venofinance.net, and flagship-web3-v1-336a757b5b637a684207a3.webflow.io from MetaMask's phishing list).

The verified dApps are not clearly distinguished from unknown dApps, as there is no indication of whether the dApp is verified or not.

The wallet displays a warning for unknown addresses both when the address is provided by a dApp and when entered manually, satisfying the check criteria.

The origin URL 'flagship-web3-v1-336a757b5b637a684207a3.webflow.io' is fully displayed in the connection dialog without truncation.

The wallet displays spam tokens by default, including tokens such as PepeFi and Apex Legeds Meme, while NFTs are not shown. Since spam tokens are not filtered, the check fails.

The connection dialog mentions that the dApp will be able to view balances and activity, but it does not mention the ability to request transaction approvals.