Rainbow

The dApp called the specified RPC endpoints, and the user rejected the requests for the sensitive methods, which confirms the authorization bypass test failed as expected.

All unauthorized requests were rejected by the wallet, except for "Add Chain", which threw an error message. No information was leaked during the process.

All requests requiring user interaction were rejected with an error due to the wallet being locked, as expected.

The wallet rejected the signing request and displayed an error message indicating a 'Chain Id mismatch'.

The wallet rejects `eth_sign` requests, returning "Error: Method not supported".

The wallet displays the message signing request without warning the user that the origin (netlify.app) differs from the domain specified in the SIWE object (opensea.io).

There is no built-in feature or a link to an external dApp for listing and revoking token approvals.

The wallet lists connected dApps and revoking access prevents further RPC requests; after disconnecting the testing dApp, eth_accounts returns empty, confirming access was fully revoked.

The chain was switched from 0x89 to 0x1 without any confirmation prompt. This indicates that the wallet is not prompting for confirmation before switching networks, which violates the acceptance criteria.

The wallet displays the expected inputs (POL, USDC) and outputs (UNI-V4-POSM) from the Uniswap transaction before signing.

The wallet displays the token and approved amount for ERC-20 approvals (e.g., Unlimited USDC.e and WSR), but omits the spender address, so the approval dialog lacks a critical detail.

All signing data is visible, scrollable and not truncated, including the `verifyingContract` for EIP-712.

The wallet does not parse OpenSea Seaport listings, displaying plain data, but it does parse Uniswap positions and ERC-20 permit details.

The wallet displays an error message "Enter a valid address" when attempting to send to an address with an incorrect EIP-55 checksum.

The sign button is enabled before scrolling to the end of the content, failing the acceptance criteria.

Addresses and transaction hashes are clickable and open a block explorer when attempting to send a transaction and from the wallet history.

Authentication (password) is required before displaying the seed phrase/private key.

The wallet UI includes a 'Lock Rainbow' button, satisfying the requirement for a manual lock control.

The auto-lock timer is set to 'None' by default, which does not meet the acceptance criteria of auto-locking within 20 minutes.

The password '11111111' is accepted, but flagged as weak. This violates the acceptance criteria that trivial passwords should not be allowed.

The wallet clearly communicates the risks of sharing the Secret Recovery Phrase and Private Key and displays a warning to the user before revealing the secrets.

The seed phrase screen allows copying mnemonics, but does not limit the time the phrase is available in the clipboard, nor does it warn about the risks of screenshots or clipboard exposure.

The wallet successfully warns when a transaction to a known malicious address is initiated via dApp. However, it fails to provide any warning for the same malicious address when entered manually, and it does not flag lookalike addresses in either dApp or manual input scenarios.

The wallet warns the user when attempting to connect to hyperliqdrop.com and venofinance.net, which are known phishing sites.

Verified dApps (Uniswap, OpenSea) are clearly distinguished from unverified dApps, displaying a blue checkmark and logo.

There is no warning shown on either manual transaction or dapp transaction review.

The full dApp origin URL is shown without truncation

The tokens view displays several tokens with small balances and questionable logos, indicating that the wallet does not hide spam tokens by default. The wallet does not have an NFTs section.

The connection dialog mentions the dApp's ability to view the user's address, balance, activity, and request approval for transactions, as expected.