Zerion

Requires user confirmation before processing each dApp request.

Requires user connection before processing each dApp request.

Requires the user to unlock the wallet before processing each dApp request.

The wallet signed the EIP-712 object despite the chainId (133337) differing from the wallet's active network, and did not show any warnings.

The `eth_sign` request was rejected with the error message: "eth_sign: Not Implemented".

The origin deploy-preview-40--wallettesting.netlify.app differs from the SIWE domain opensea.io, but the wallet does not display a warning, and the user is able to sign the message.

The wallet does not have any functionality to list or revoke existing token approvals as required by the acceptance criteria.

The wallet lists connected dApps, and after disconnecting the testing dApp, further RPC requests resulted in errors, indicating that access was successfully revoked.

Chain switched without confirmation, and the RPC call returned success.

The wallet previews show the expected inputs and outputs from providing liquidity (Uniswap) and performing a swap (Sushi) before signing.

The wallet displays the token (USDC), spender (app.uniswap.org), and approved amount (Unlimited USDC) as requested.

The EIP712 data, including verifyingContract, and long personal_sign messages are fully displayed and scrollable.

The wallet displays the EIP-712 signature request as raw JSON instead of structured, human-readable details.

The dApp transaction was blocked due to a bad address checksum, but the manual transaction did not flag the incorrect checksum and allowed the transaction to proceed.

The Sign button is enabled without scrolling to the end of the content.

The address in the transaction details view is shown to open the block explorer and in the transaction history view the address and hash both open the block explorer.

A password is required to reveal the recovery phrase.

The wallet includes a manual lock control, as evidenced by the 'Lock Wallet' button within the settings.

The wallet does have an auto-lock setting, but the default is 12 hours, which does not meet the acceptance criteria to auto-lock within 20 minutes.

The password requirements include a minimum of 6 characters, which does not meet the acceptance criteria of at least 8 characters.

The wallet displays a warning to the user not to share their recovery phrase or passcode with anyone, including Zerion team members.

The seed phrase can be copied to the clipboard, but there is no indication of a time limit or warning about clipboard risks.

The wallet correctly flags a transaction to a known malicious address when initiated via dApp. However, it fails to display any warning for the same malicious address when entered manually in the wallet UI, and also fails to flag lookalike addresses in both dApp and manual input scenarios.

The wallet correctly blocked connections to known phishing sites hyperliqdrop.com and venofinance.net.

The connection requests for verified (Uniswap, 1inch, Sushi), unverified (deploy-preview-40--wallettesting.netlify.app) or a phishing (flagship-web3-v1-336a757b5b637a684207a3.webflow.io) dApps are displayed identically. There is no clear distinction.

No warning or indicator is displayed for unknown addresses.

The full dApp origin URL is displayed in the connection dialog without truncation.

The NFTs tab is showing NFTs by default, and one is clearly identified as a spam NFT. Therefore, the wallet is not hiding spam NFTs by default.

The connection dialog states the site will have read-only access to balances and transaction activity, and cannot access funds without approval.