A familiar swap interface can still request an unfamiliar spender
Verify the transaction even on a familiar domain because a compromised interface can request different permissions or destinations.
Explore the reference
Swap security
Check permissions, signatures and contracts before putting assets at risk.
49 guides · Page 1 of 3
A signature costs no gas: can it still authorize token movement?
An offchain signature can authorize later token movement even when signing itself has no network fee.
A swap site asks for a recovery phrase: stop the interaction
A DEX or aggregator does not need the recovery phrase that controls your wallet; identify the request as a secret-exposure risk.
Address poisoning around swaps: why history is a poor address book
Avoid copying lookalike recipient addresses planted in transaction history around wallet activity.
An aggregator reports a security incident: what should users check?
Review the exact affected contracts, time window and permissions after an aggregator announces a security incident.
Can a honeypot checker prove a token is sellable?
Treat token scanner results as scoped evidence, including unknown states, rather than a guarantee of future sellability.
Can an old approval spend tokens I receive later?
Understand why an old remaining allowance can matter again after more of the same token arrives in an account.
Can anyone reverse a confirmed swap or recover stolen tokens?
Understand why confirmed swaps are not normally reversible and which destination-dependent recovery paths may exist.
Can I revoke a permit signature that has not been used?
Unused permit signatures require scheme-specific invalidation; clearing a visible allowance may not permanently cancel the signature.
Can switching RPCs expose a previously private swap?
A pending private transaction can lose its intended propagation protection if a wallet rebroadcasts it through a public endpoint.
Check the wallet installation source before connecting to a DEX
Check wallet installation provenance before entrusting an extension with signing access or recovery material.
Clear signing helps, but which swap facts still need checking?
Use readable transaction review to verify intent while recognizing that it does not audit the underlying protocol.
Do I need to revoke the same token approval on every chain?
Token permissions are chain-local; clearing an allowance on one chain does not automatically clear similar permissions elsewhere.
Does a one-time Permit2 signature leave a standing allowance?
A consumed SignatureTransfer authorization does not create a recurring spender allowance, but the token approval to Permit2 can remain.
Does a successful small sell prove a token is safe?
A successful small token sale is evidence for that transaction, not a guarantee that a later larger exit will work.
Does an approval remain active after the swap fails?
A separately confirmed approval can remain active when a later swap reverts or never submits.
Does connecting a wallet expose my tokens or just my address?
Distinguish ordinary account connection from token approval, signing and broader delegated permissions.
Does disconnecting a wallet revoke its token approvals?
Disconnecting ends an application session, while token approvals remain in the token contract until changed or otherwise exhausted.
Exact amount or unlimited approval: what changes your exposure?
Compare the permission exposure of a narrowly sized allowance with a reusable unlimited approval.
Gas disappears immediately after funding a wallet: suspect a sweeper
Recognize immediate outgoing gas transfers as possible key compromise and avoid repeatedly funding an account controlled by a sweeper.