On this page
Core concepts
From a risk perspective, signature requests and token approvals deserve an independent review. Once a transaction is confirmed on-chain, a wallet normally cannot reverse it unilaterally. DApps and smart contracts can also introduce permission and contract risks, so every signature, approval and transfer should be understood before it is accepted.
For DApp connections, first define its role in the current task, then check whether domain checks and signature requests are consistent. When token approvals is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For disconnecting, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: DApp connections
- Cross-check: domain checks and signature requests
- Review carefully: token approvals
- Verify afterward: disconnecting
Checks before you act
After a Web3 & DApps task is completed, review disconnecting and DApp connections to make sure the outcome matches the intent. Long-lived approvals and persistent connections should be revisited periodically. Good wallet hygiene is a repeated process of checking critical details and retaining traceable on-chain information, not a one-time setting.
For domain checks, first define its role in the current task, then check whether signature requests and token approvals are consistent. When disconnecting is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For DApp connections, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: domain checks
- Cross-check: signature requests and token approvals
- Review carefully: disconnecting
- Verify afterward: DApp connections
How to evaluate a live request
To understand Web3 & DApps, treat signature requests and token approvals as parts of the same on-chain workflow. The interface is only the entry point; the selected network, current chain state and permission scope determine what actually happens. Confirm the destination, source and network before continuing so the meaning of the request stays clear.
For signature requests, first define its role in the current task, then check whether token approvals and disconnecting are consistent. When DApp connections is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For domain checks, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: signature requests
- Cross-check: token approvals and disconnecting
- Review carefully: DApp connections
- Verify afterward: domain checks
Risks and boundaries
token approvals rarely appears in isolation. It often intersects with disconnecting and DApp connections. A useful pattern is to separate each action into four checks: identify the object, verify the network, review permissions, and confirm the result. If one of those checks cannot be completed, stop and verify rather than relying on an unfamiliar site or remote instructions.
For token approvals, first define its role in the current task, then check whether disconnecting and DApp connections are consistent. When domain checks is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For signature requests, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: token approvals
- Cross-check: disconnecting and DApp connections
- Review carefully: domain checks
- Verify afterward: signature requests
How to verify the outcome
When using imtoken for Web3 & DApps, prioritize information that can be independently verified, such as addresses, network names, contract addresses, transaction hashes and block-explorer records. Visual design, urgency messages or claims from an unknown support account are not substitutes for verifiable on-chain details.
For disconnecting, first define its role in the current task, then check whether DApp connections and domain checks are consistent. When signature requests is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For token approvals, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: disconnecting
- Cross-check: DApp connections and domain checks
- Review carefully: signature requests
- Verify afterward: token approvals
Practical checklist
- Never share your seed phrase, private key or verification code.
- Verify the address, network and amount before sending.
- Review each DApp signature and token approval independently.
- Use transaction hashes and block explorers to verify on-chain status.
- Revoke approvals and disconnect sessions that are no longer needed.