5

When a user goes to a crypto-related website (like Pancakeswap for example), the website asks the user to connect their wallet (eg Metamask, Binance Chain Wallet). I have several questions:

  1. What exactly happens when the user connects their wallet? Is there a transaction that records this "connection" on the blockchain, or is the fact that the wallet is connected to this site somehow stored locally on the user's machine? How does the website know that the user agreed to connect their wallet at some point in the past? I suspect this has something to do with web3.js somehow being injected, but I'm not sure.

  2. If I run a site locally (on localhost), is it safe to connect my wallet to localhost? Or does this create security risks?

Improve this question

3 Answers 3

Reset to default
11

Connecting your wallet doesn't really do much: it doesn't send any transactions. About all it does it gives your wallet's public address to the website and the possibility for the website to request actions from the wallet - actions which you, as a user, need to accept manually.

In theory, everything would be smoother and more user friendly if your wallet automatically connected to a site whenever needed. But the connection is not automatic for security reasons: by auto-connecting (or even just by telling the site that you have a wallet) you would give too much information to the website. A malicious website might try to detect whether a user has a wallet, and if does, then the site could start various crypto scams / phishing attacks. If the website has no idea whether you even have a wallet (as is the case) unless you connect your wallet, the website has no idea whether it's worth it to even try some sort of nasty stuff.

So if you run code you are familiar with (or trust), you can safely connect your wallet locally. Also in general connecting your wallet to any website isn't a big security risk, but it's simply better to not connect unless you have a need for it.

Improve this answer
3

Here is official answer: https://docs.metamask.io/guide/getting-started.html#connecting-to-metamask

Very sample: just allow website to read your wallet address

no transaction, no risk (like tell a website your email address, maybe only get some spam. in web3 world ,you may get some "spam coin")

Improve this answer
3
  • This only says what happens on the client side. It doesn't really say what happens on the blockchain side. Thanks anyway.
    – Marc
    Sep 12, 2022 at 17:56
  • @Marc there is noting happen in the chain. you can use hardhat run test chain, then add test chain to your matemask. try connect any web3 website. you can see nothing output when confirm connect.
    – Robin
    Sep 13, 2022 at 12:54
  • you can read eip-1102 to get more info: eips.ethereum.org/EIPS/eip-1102
    – Robin
    Sep 13, 2022 at 12:59
3

Just adding a bit more caution to the accepted answer:

As per Metamask, connecting your wallet allows the following:

| See address, account balance, activity and suggest transactions to approve

Metamask strongly recommends that you only connect with websites that you trust. (https://metamask.zendesk.com/hc/en-us/articles/4405506066331-User-guide-Dapps).

This is because there are scams in which a website's button may say that it's asking you only to connect, but in reality the prompt sent to Metamask is asking for more than just a wallet connection.

To be safe, it's best to read exactly what the Metamask/wallet prompt is asking for.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.