Rabby Wallet

The wallet requires user confirmation in order to process requests from dApps to all RPC endpoints.

The test dApp rejects all requests that require authorization, including eth_accounts, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData* family, personal_sign, and eth_sendTransaction without an active connection to the wallet.

When the wallet is locked, its connection to the dApp is removed, and all RPC endpoint requests fail when sent.

The wallet displays an error message indicating that the chainId in the EIP-712 object should be the same as the current chainId.

The wallet rejects `eth_sign` requests and displays a warning message, as expected.

The wallet did not warn about the domain mismatch between the dApp (deploy-preview-40--wallettesti...) and the SIWE message (https://opensea.io). The signing proceeded without any warning.

The wallet lists existing token approvals and provides the ability to revoke them.

The wallet lists the connected dApps, and revoking access prevents further RPC requests from the disconnected dApp.

The wallet automatically switches the chain without a confirmation prompt.

The wallet shows the expected inputs (0.0001 USDC, 0.0010 POL) and outputs from the add liquidity transaction before signing.

The wallet displays the token being approved (USDC), the spender (Uniswap Permit2) and the approved amount (115,792,089,237,316).

The content is visible and scrollable for both eth_signTypedData and personal_sign.

The wallet renders structured, human-readable signing details and also a raw JSON.

The wallet proceeds with transactions to an address with an incorrect EIP-55 checksum, both manually and from a dApp, without displaying any warning or blocking the transaction.

The sign button is enabled before the end of the message is reached.

Addresses are clickable links within the wallets' transaction history and also the address is a clickable link when sending a transaction via dApp.

Password authentication is required before displaying the seed phrase.

The wallet includes a manual lock control, as evidenced by the "Lock Wallet" option in the settings menu.

The wallet has an auto-lock setting, but it is set to 'Never' by default.

The wallet accepted '11111111' as a password while the acceptance criteria states that it should not allow trivial passwords.

The warning shown on the seed phrase screen indicates the risks of revealing the seed phrase to others, and is shown before the seed phrase itself.

The wallet does not provide a warning about the risks of copying mnemonics to the clipboard or limits their exposure.

The wallet successfully flagged the lookalike address in both dApp and direct UI transaction attempts. However, it failed to provide any warnings for the known malicious address when tested via dApp and direct UI.

The wallet warns about the hyperliqdop.com site being unlisted and having low popularity, but the first site 'flagship-web3-v1-336a757b5b637a684207a3.webflow.io' which is present on the MetaMask phishing list (as flagship-web3.webflow.io) does not trigger a warning.

The wallet visibly distinguishes verified dApps from unknown ones: Uniswap shows a 'Verified by Rabby' badge and a 'Safe' risk detail, while the unknown dApp (deploy-preview-50--wallettesting.netlify.app) shows warnings and no verification badge.

The wallet shows a warning when sending to an address that has not been transacted with before.

The full dApp origin URL is shown in the connection dialog without truncation.

Spam NFTs and tokens are being displayed within the NFTs section.

The connection dialog does not clearly mention the ability to view the user's balance and activity, as well as to request transaction approvals.