1

I'm a developer and now using metamask as a user. To explore a dapp which is largely unknown to me, and how it functions, I have to connect my wallet, and I am given the message "only connect with sites you trust".

Trust is not an atomic concept, though - trust to do what, so this message is pretty unhelpful.

I'd like a clear description if possible of what connecting does and does not do. Just saying "only connect if you trust" seems to me a lost opportunity to improve security in practice.

e.g., it could say

"connecting to this site will allow it to read your wallet balances" (with tooltip: but will not allow it to spend your funds - that requires a further transaction authorisation from you)"

Is the statement above correct? As precise as it can be?

So, here's how I understand it (please correct me!)

  1. 'connect' = allow dapp to read wallet balances

  2. 'approve' = allow dapp to spend a specific token up to a spending limit

  3. 'authorise transaction' = actually spend funds

I'm also not clear on step (2) where you can also choose a spending limit lower than effectively infinite - it seems as if at that step, step (2), the dapp can spend funds in your wallet. But this seems untrue because if that were the case what is the point of (3). And if (3) is required, what is the point of (2)?

Sorry for the slightly frustrated sounding language here... Thanks.

Improve this question
1
  • 1
    Let's say you have a token in your wallet like USDT or DAI. For you to spend those tokens, the process would be to first approve the amount of tokens you want to spend and then authorize the transaction so basically you have 2 transactions you have to approve, one for allowance(the 2nd step) and one for authorizing the transaction(the 3rd step).Your statement is correct, the website you're connecting to can read balances from your wallet and fetch your wallet address but you are the one who has the ability to approve transactions.
    – Icarus23
    Oct 13, 2021 at 8:22

1 Answer 1

Reset to default
1

"Connecting" your wallet to a website does two things:

  1. It allows the website to know that you have a crypto wallet (implicitly)

  2. It gives the website your wallet's public address (explicitly)

Once the website has your address, they can use it to read whatever information there is publicly available in the blockchain, for that address. One such information is token balance in a certain token contract. To read token balance, they need the token contract address and the wallet address.

So, yes, it can read your "wallet balance", but in a bit broader sense.

Approval approves an address to spend X amount of your tokens, and this requires a real transaction. (To be more precise: approval is a transaction.) The website may build also whatever other transactions and suggest/ask you to execute those - but you have to explicitly (accept to) send the transaction.

Improve this answer
2
  • does "connecting" involve any signing with your private key? If it doesn't, how can the receiver be sure that the public address you give to them actually belongs to you?
    – splinter123
    May 22, 2022 at 11:45
  • No private key is not involved. The website simply trusts that it gets a proper address, but that shouldn't be enough to prove ownership. To prove ownership you always have to use the private key. I'm not sure how easy it would be to fake the connected address.
    – Lauri Peltonen
    May 22, 2022 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.