Transactions · 26 / 86 · 2 min
Signing and connecting
Connecting a wallet is permission for a site to ask you to sign. It is not, by itself, a payment. A later signature or approval can be the payment.
Connecting lets a site ask. The signature, or an earlier approval, is what moves funds.
A worked case
A site connects and nothing leaves the wallet, so the person relaxes. The next prompt is an approval for the token. They sign because the first step was harmless. The second step was the payment.
Connect
The site learns your address. That address has a public history. Connecting is not harmless if you wanted that history private.
Sign and approve
A signature can log you in, list you for an airdrop, or authorise a contract. An approval can let that contract move a token later, when you are not looking.
Read the wallet prompt. If it is a long hex string and a stranger's site, refuse it. Open the real site from a bookmark you made.
The login that was an allowance
Connecting a wallet gives a site permission to ask you to sign. It does not, by itself, send coins. The next prompt might be a login message, a listing, or a token approval. Approvals became the common drain. You allow a contract to move a token up to some amount, often unlimited, and the move can happen later, in a transaction you do not click. Revoke tools exist because people discovered old approvals the way you discover an old direct debit.
The 2020 Twitter hack was the crude version: send coins to this address. The contract version does not even ask you to send. It asks you to permit. People who would never paste a seed will sign a hex string because the wallet says the site is known. Known is not the same as this particular message.
Read the human sentence on the device or the wallet. If there is no human sentence, do not sign it to see what happens. Disconnecting later does not cancel an approval you already gave.
Read it yourself
These links are the record. They are not a recommendation, and they are not instructions. A news story or a court paper can still be wrong about a detail. The check does not change because a famous name is in the story.
Apply the check
Open a question. The line is about this topic. It is not a verdict that anything is safe.
The contract you approved.
The site that built the message.
The approval, until you revoke it. The signature, once it is sent.
Check yourself
Is connecting a wallet the same as sending coins?
Not by itself. A later approval can still move tokens.
After this you can treat connect, sign, and approve as three different permissions.