u/davidt2021

The truth is, you can’t be 100% sure, but you can significantly reduce your risk by taking a few extra steps to understand what you are signing.

Here are a few key things I always check before approving any transaction:

1. Make sure you are on the right website

Many wallet drain scams begin with fake websites that look almost identical to the official ones.

Ask yourself:

• Is the domain name 100% correct?
• Did I open the dApp from a bookmark or an official project link?
• Is there anything suspicious or unusual about the URL?

2. Read the transaction details carefully

Review the expected actions before clicking confirm. Are you:

• Swapping a token?
• Approving a token allowance?
• Signing a message?

Make sure the transaction details match your intended action.

3. Pay close attention to token approvals

Before confirming, check:

• Which token is being approved?
• Which contract address is being granted approval?
• Whether unlimited approval is being requested.

Note: Unlimited approvals may seem convenient, but they significantly increase your risk if the smart contract is ever exploited or turns out to be malicious.

4. Never ignore security warnings

Stop and investigate before continuing if MetaMask flags a transaction. However, keep in mind that the absence of a warning does not automatically mean the transaction is safe.

5. Be careful with signatures

Be cautious with off-chain signatures (e.g., eth_sign or permit signatures). If the transaction data is unclear or you don’t understand why you are being asked to sign, stop and investigate.

---

📋 My Quick Checklist

• Is the website domain correct?
• Why is this transaction being requested right now?
• What specific action is this transaction doing?
• Is the contract address verified/correct?
• Are there any security warnings?
• Is the approval allowance appropriate?

For more details, check out MetaMask's Guide on Security Alerts.

What are the main things you always check before signing a MetaMask transaction?