On-chain hygiene

A token approval lets a contract spend that token from your wallet, up to a limit you set. Many sites request an unlimited allowance because it is convenient for them. It is a standing permission. If the contract is later compromised, the permission is still valid.

Approve the amount you intend to use, or revoke the allowance when the job is done. Revoking is a normal piece of housekeeping, like locking a door, not a sign that something has already gone wrong.

Read the wallet prompt. The network, the token, the spender, and the amount should all be familiar. If the prompt is a blur of hex and urgency, the correct trade is no trade.

Address poisoning puts a lookalike address in your history — same first and last characters, different middle — hoping you copy it next time. Check the entire address, or use an address book you created yourself. Do not trust the preview in a chat.

Blind signing asks you to authorize a payload the wallet cannot decode. Hardware wallets are not magic if you confirm a hash you did not verify. If a site insists you sign in a hurry, close it.

Bookmarks beat search ads. The fake site is often one letter off, and the padlock only means the connection is encrypted, not that the other end is who you wanted.