How to read an audit claim before using an aggregator
Read the audit’s scope, version, findings and deployment relevance before treating an aggregator’s audit badge as security evidence.
Explore the reference
Swap security — page 2
Check permissions, signatures and contracts before putting assets at risk.
49 guides · Page 2 of 3
How to reduce sandwich exposure when swapping
Reduce sandwich exposure by reviewing execution bounds, route liquidity and the actual coverage of private submission.
How to revoke an unused swap allowance safely
Remove an unwanted standard token allowance and verify the onchain result without confusing revocation with recovery.
How to verify an aggregator website without trusting a search ad
Verify the real application domain and contract request when search ads or copied swap interfaces look convincing.
How to verify the spender before approving an aggregator
Verify the exact contract receiving token permission, rather than confusing it with the token or execution router.
I signed an unknown swap request: what should I check first?
Triage an unfamiliar signed request by identifying whether it exposed a key, granted permission or authorized an order.
Locked liquidity does not settle every token safety question
Check the scope and duration of a liquidity lock without assuming it removes token or execution risk.
Ownership renounced: what token risks remain?
Understand which authority a renounceOwnership transaction removes and which independent risks may remain.
Pasted recipient changed: how to stop a misdirected swap
Stop and investigate when a pasted swap recipient differs from the address you intended to use.
Permit signature versus token approval: which permission are you granting?
Compare a standard onchain token approval with an ERC-2612 signed permit and understand what each authorizes.
Permit2 has two permission layers: what should you review?
Separate the token allowance granted to Permit2 from the spender authorization Permit2 checks for an application.
Private RPC routing: which protections should you verify?
Compare private transaction services by chain support, information sharing, fallback and execution rules rather than the word private.
Recovery agents asking for an unlock fee: what evidence matters?
Evaluate recovery claims by asking who can move the funds and rejecting fabricated unlock payments or secret requests.
Same ticker, different token: verify the contract before swapping
Identify a token by chain and contract address instead of trusting a copied ticker, logo or wallet valuation.
Stolen seed or malicious approval: why the response differs
Choose the right response by distinguishing stolen signing control from a malicious token permission.
Unexpected tokens in your wallet: when leaving them alone is enough
An unsolicited token balance is not an obligation to claim, sell or visit the website embedded in its name.
Using a separate swap wallet to contain permission risk
Use account separation to limit approval exposure while understanding the limits of shared secrets and public funding links.
Verified source code is not an audit or safety guarantee
A verified-source badge helps inspect deployed code but does not certify that the contract is safe to approve or trade.
Verify the recipient on the device before approving a swap
Use the hardware device’s trusted display to check destination details while distinguishing router and final token recipient.
Wallet security warning during a swap: what to verify before proceeding
Investigate a wallet’s site, token, address or transaction warning before deciding whether the requested swap is acceptable.