Reading wallet signing requests

Every action in a wallet starts with a request to sign. Some requests are transactions, which change the state of the chain once they are sent, such as moving a coin or calling a contract. Others are signed messages, which are free to produce and are used to log in to a site or to authorize something later. A message can look harmless, yet some message formats grant a site a permission that can be used afterwards. The wallet's signing window is therefore the last place where you can see what is being asked. Look at four parts: which site made the request, which network it targets, which address or contract is named, and which action is described in the details panel, not only in the headline.

Permissions deserve extra attention because they outlast the moment of signing. An approval lets a contract move a token on your behalf up to a stated limit, and a site connection lets a page read your public address and propose further requests. Neither moves anything by itself, but a stale permission can be used later by the contract that received it. Habits that help: grant the amount a task needs rather than an unlimited one, disconnect sites you no longer use, and treat a request you did not expect as a reason to close the window. If the details panel shows unreadable data and the site cannot explain it, declining costs nothing, whereas a signature cannot be taken back.