Core security principles
When working with Message signing, it helps to understand how it connects with Transaction signing and Request origin.
The goal of Signature Requests is not to promise perfect security. It is to reduce avoidable exposure through repeatable checks. With Message signing, Transaction signing, Request origin, Content review and Rejecting risky requests, separate the protection of recovery material from request validation, permission review and device hygiene. These risks come from different sources, so no single password, device or confirmation step can cover every scenario.
Seed phrases and private keys should remain under the user’s control. Official personnel will not ask for them, and they should never be sent to another person together with verification codes. Suspicious requests involving Message signing, Transaction signing and Request origin may ask for recovery screenshots, remote-control access, unknown scripts or approvals to unfamiliar contracts. Treat those as warning signs, stop the interaction and restart from a source you have independently verified.
In practice, Message signing rarely exists in isolation. It may affect the outcome together with Transaction signing, or behave differently because the state of Request origin has changed. Compare interface information with public on-chain data where possible and keep the purpose of the current action clear. If a request involves a signature, approval or asset transfer, approve only what you can explain; otherwise exit and verify the source again.
Common risk scenarios
When working with Transaction signing, it helps to understand how it connects with Request origin and Content review.
Seed phrases and private keys should remain under the user’s control. Official personnel will not ask for them, and they should never be sent to another person together with verification codes. Suspicious requests involving Message signing, Transaction signing, Request origin, Content review and Rejecting risky requests may ask for recovery screenshots, remote-control access, unknown scripts or approvals to unfamiliar contracts. Treat those as warning signs, stop the interaction and restart from a source you have independently verified.
Important: seed phrases and private keys remain under the user’s control, and official personnel will not ask for them. Verify the address, network and amount before sending. On-chain transactions generally cannot be reversed by a wallet provider. Third-party DApps and smart contracts may be risky, so review approval targets and permission scope and consider revoking permissions you no longer need.
Transactions and approvals can have lasting consequences. Mistakes involving Transaction signing, Request origin and Content review may be difficult or impossible to undo once submitted, so verify the address, network, amount, approval target and permission scope before confirming. Consider revoking permissions that are no longer needed. Third-party DApps and smart contracts may contain technical, operational or fraudulent risks, so each request should be evaluated on its own merits.
In practice, Transaction signing rarely exists in isolation. It may affect the outcome together with Request origin, or behave differently because the state of Content review has changed. Compare interface information with public on-chain data where possible and keep the purpose of the current action clear. If a request involves a signature, approval or asset transfer, approve only what you can explain; otherwise exit and verify the source again.
Quick review
- Confirm that information related to Message signing belongs to the network or request you are actually using.
- Confirm that information related to Transaction signing belongs to the network or request you are actually using.
- Confirm that information related to Request origin belongs to the network or request you are actually using.
- Confirm that information related to Content review belongs to the network or request you are actually using.
How to recognize suspicious requests
When working with Request origin, it helps to understand how it connects with Content review and Rejecting risky requests.
Transactions and approvals can have lasting consequences. Mistakes involving Message signing, Transaction signing, Request origin, Content review and Rejecting risky requests may be difficult or impossible to undo once submitted, so verify the address, network, amount, approval target and permission scope before confirming. Consider revoking permissions that are no longer needed. Third-party DApps and smart contracts may contain technical, operational or fraudulent risks, so each request should be evaluated on its own merits.
The goal of Signature Requests is not to promise perfect security. It is to reduce avoidable exposure through repeatable checks. With Request origin, Content review and Rejecting risky requests, separate the protection of recovery material from request validation, permission review and device hygiene. These risks come from different sources, so no single password, device or confirmation step can cover every scenario.
In practice, Request origin rarely exists in isolation. It may affect the outcome together with Content review, or behave differently because the state of Rejecting risky requests has changed. Compare interface information with public on-chain data where possible and keep the purpose of the current action clear. If a request involves a signature, approval or asset transfer, approve only what you can explain; otherwise exit and verify the source again.
What to do when something looks wrong
When working with Content review, it helps to understand how it connects with Rejecting risky requests and Message signing.
The goal of Signature Requests is not to promise perfect security. It is to reduce avoidable exposure through repeatable checks. With Message signing, Transaction signing, Request origin, Content review and Rejecting risky requests, separate the protection of recovery material from request validation, permission review and device hygiene. These risks come from different sources, so no single password, device or confirmation step can cover every scenario.
Seed phrases and private keys should remain under the user’s control. Official personnel will not ask for them, and they should never be sent to another person together with verification codes. Suspicious requests involving Content review, Rejecting risky requests and Message signing may ask for recovery screenshots, remote-control access, unknown scripts or approvals to unfamiliar contracts. Treat those as warning signs, stop the interaction and restart from a source you have independently verified.
In practice, Content review rarely exists in isolation. It may affect the outcome together with Rejecting risky requests, or behave differently because the state of Message signing has changed. Compare interface information with public on-chain data where possible and keep the purpose of the current action clear. If a request involves a signature, approval or asset transfer, approve only what you can explain; otherwise exit and verify the source again.
A long-term security checklist
When working with Rejecting risky requests, it helps to understand how it connects with Message signing and Transaction signing.
Seed phrases and private keys should remain under the user’s control. Official personnel will not ask for them, and they should never be sent to another person together with verification codes. Suspicious requests involving Message signing, Transaction signing, Request origin, Content review and Rejecting risky requests may ask for recovery screenshots, remote-control access, unknown scripts or approvals to unfamiliar contracts. Treat those as warning signs, stop the interaction and restart from a source you have independently verified.
Transactions and approvals can have lasting consequences. Mistakes involving Rejecting risky requests, Message signing and Transaction signing may be difficult or impossible to undo once submitted, so verify the address, network, amount, approval target and permission scope before confirming. Consider revoking permissions that are no longer needed. Third-party DApps and smart contracts may contain technical, operational or fraudulent risks, so each request should be evaluated on its own merits.
In practice, Rejecting risky requests rarely exists in isolation. It may affect the outcome together with Message signing, or behave differently because the state of Transaction signing has changed. Compare interface information with public on-chain data where possible and keep the purpose of the current action clear. If a request involves a signature, approval or asset transfer, approve only what you can explain; otherwise exit and verify the source again.