Uniswap

The wallet requires user confirmation for all supported privileged endpoints (eth_signTypedData, personal_sign, eth_sendTransaction) and returns an unsupported-method error for the other tested endpoints, ensuring no request was executed without confirmation.

The wallet rejected every privileged RPC method (eth_accounts, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData, personal_sign, eth_sendTransaction) with an error and returned no data, confirming that dApp access requires explicit user approval.

The wallet requires the user to unlock before processing any dApp request; all tested methods (wallet_addEthereumChain, wallet_watchAsset, eth_decrypt, eth_getEncryptionPublicKey, eth_signTypedData, personal_sign, eth_sendTransaction) were rejected or received no response while locked, with no data returned.

The wallet displays an error message "Chain ID on message does not match the chain ID set on the extension", when attempting to sign an EIP-712 object with a chainId different from the wallet's active network.

The wallet rejects `eth_sign` requests as expected, returning an error message that it does not support `eth_sign` because it is deprecated.

The wallet does not display a warning or block the signing request when the dApp origin differs from the domain specified in the SIWE object.

The wallet does not allow users to revoke token approvals through its own built-in revocation system or links to external dApps.

The wallet lists the connected dApps and after disconnecting a dApp, the RPC requests from it are rejected.

The wallet switched to Ethereum Mainnet and zkSync Era Mainnet without displaying a confirmation prompt, allowing chain switches without user confirmation.

The wallet displays the expected transaction effects for both liquidity provision (sending POL, receiving UNI-V3-POS) and swap (sending POL, receiving USDC) before signing.

The wallet clearly displays the token (USDC) and the approved amount (unlimited), but not the spender (Uniswap).

The data is scrollable in personal_sign and eth_signTypedData (EIP-712) signature requests, and the verifyingContract parameter is also displayed.

The Seaport EIP-712 signature request is rendered as raw JSON, rather than structured, human-readable details.

The wallet does not allow the manual transaction to proceed because the checksum is invalid. When attempting via the dApp, the transaction cannot be processed, likely due to the same issue.

The sign button is enabled before scrolling to the end of the message, failing the acceptance criteria.

The address, transaction, and contract address are clickable links that redirect to the block explorer in both transaction history and send transaction screens.

The wallet requires password authentication before displaying the recovery phrase.

The screenshot shows a 'Lock wallet' button at the bottom of the settings page.

The default auto-lock timeout is 30 minutes, which does not meet the acceptance criteria of auto-locking within 20 minutes.

The password validation correctly rejects trivial passwords that are at least 8 characters long. The validation message is "This password is too weak".

The risks of sharing the recovery phrase are communicated clearly on the screen, including not sharing it, viewing it in private, and not entering it on any websites.

The seed phrase was able to be copied with no time limit, warning about risks, or prevention of copying.

The wallet blocks/warns for the known malicious address (0x742428be...8b76d37d) on both manual and dApp entry, and warns with a generic 'New address' warning for the lookalike address (0x8730ae...1FDa54) on manual entry, but it does not warn for the lookalike address when supplied by a dApp.

The wallet warns the user about malicious apps, as expected. Hyperliqidrop.com and venofinance.net are detected as malicious apps.

Unknown dApps also have a checkmark, so verified dApps are not clearly distinguished from unknown ones.

The wallet warns about the new address when the transaction is done manually. However, it does not do so when the transaction comes from a dApp.

The full dApp origin URL is displayed without truncation in the connection dialog.

Spam tokens and NFTs are hidden by default as indicated by the "Hidden tokens" section.

The connection dialog clearly states that the dApp will be able to "View your balance and activity" and "Request transaction approvals", which matches the acceptance criteria.