Wallet Permissions and Connected Sites

Wallet connected sites are websites you have authorized to see your wallet address and send requests to your wallet; a connection alone does not let a site move your funds. Funds move only when you approve a transaction, grant a token approval or sign a permit-style message. To stay safe, regularly remove connections you no longer use, review token approvals separately, and read every signing prompt carefully.

Many people believe that "disconnecting" a site makes them safe, or that connecting is itself dangerous. Both ideas are incomplete. Understanding the three layers of wallet permissions helps you focus on what actually protects your assets.

The Three Layers of Wallet Permissions

Layer 1: Connections

When you click "Connect wallet," your wallet asks whether to share your account with the site. If you agree, the site can read your public address and balances, which are public on the blockchain anyway, and can send requests for you to sign.

A connection is a privacy and convenience setting. It tells sites who you are, which can be used to target you, but it does not let them take funds.

Layer 2: Token approvals

To swap or deposit a token, a smart contract usually needs an allowance. You grant it through an approval transaction. Many apps ask for an unlimited allowance so you do not need to approve again. Those permissions stay active on-chain indefinitely. Our step-by-step guide on how to revoke token approvals shows how to clean them up.

Layer 3: Signatures

Wallets can sign two broad kinds of things:

• Transactions, which are sent to the blockchain and change state, such as transfers, swaps or approvals.
• Messages, which are signed off-chain. Some are harmless, like signing in to a website. Others, such as token permits or NFT marketplace listings, can authorize someone to move your assets later.

Attackers favor message signatures because they look harmless and do not cost gas. See ice phishing and permit signatures.

How to Review Connected Sites

The exact menus differ by wallet, but the process is similar:

1. 1Open your wallet and go to settings or the account menu.
2. 2Find the section called "Connected sites," "Connections" or "Permissions."
3. 3Review each site listed for each account and network.
4. 4Disconnect anything you do not recognize or no longer use.
5. 5Repeat for every account in the wallet; connections are often per account.

For mobile wallets that use WalletConnect, also check the list of active sessions and end old ones.

How to Read a Wallet Prompt

Before clicking confirm, check:

• The site. Does the domain shown in the prompt match the site you meant to use?
• The action. Is it a transfer, an approval, a listing, or a sign-in message?
• The contract. Which address are you interacting with, and is it the official contract?
• The amount. For approvals, is the allowance limited or unlimited? Edit it down if your wallet allows.
• The assets. Does the wallet's simulation show assets leaving your account that you did not expect?

If anything is unclear, reject the request. A legitimate site will let you try again later.

Warning Signs of a Malicious Request

1. 1A site you just opened immediately asks for a signature before you have done anything.
2. 2A "claim," "verify" or "sync" button that triggers an approval or permit.
3. 3A request to approve tokens unrelated to the action you are taking.
4. 4A setApprovalForAll request for a valuable NFT collection when you are not listing.
5. 5A blind-signing warning on a hardware wallet for what should be a simple action.
6. 6Pressure: countdowns, limited claims, or messages saying your wallet will be blocked.

Good Permission Hygiene

• Use separate wallets. Keep a burner wallet for mints, airdrops and new apps; keep savings in a wallet that rarely connects to anything.
• Approve limited amounts. Approve what you need for the action, not unlimited allowances.
• Review monthly or quarterly. Check connections and approvals together.
• Use a hardware wallet for larger balances. It forces you to confirm on a separate screen, though you still need to read what it shows.
• Keep the wallet app updated. Newer versions often add better transaction previews and warnings.

Common Misconceptions

• "I disconnected, so I'm safe." Approvals and signatures remain valid after disconnecting.
• "Connecting is dangerous." Connecting exposes your address; signing is what creates risk.
• "Signing a message is free, so it's harmless." Some messages authorize transfers.
• "Only big wallets get targeted." Drainers sweep wallets of any size automatically.

Bottom line

Think of your wallet permissions in three layers: connections, approvals and signatures. Connections are mostly about privacy, while approvals and signatures control your money. Disconnect unused sites, revoke old approvals, and read every prompt as if your savings depend on it, because they do. For a broader comparison of wallet types, see custodial vs non-custodial wallets.