How to Review a WalletConnect Signature Request

A dApp can ask Gem Wallet to sign a message through WalletConnect. A signature can prove wallet ownership, sign in to a service, approve token access, place an order, or authorize another action without immediately submitting a normal transfer.

Message signing usually does not require a network fee, but the resulting signature can still have financial consequences. Treat every request with the same care as a transaction.

danger

Reject any signature request you did not initiate. Never sign a message to verify, synchronize, repair, or unlock your wallet, and never enter your Secret Phrase or private key into a dApp.

Signature Requests Gem Wallet Can Display

Gem Wallet distinguishes several message formats:

Request	What it commonly does	Title shown by Gem Wallet
Plain-text message	Proves control of an address or accepts a readable statement	Review Request
EIP-712 typed data	Authorizes a structured Ethereum action such as a Permit, order, or protocol request	Review Request
Sign in with Ethereum	Authenticates an Ethereum account with a service	Sign In with Ethereum
Sign in with Solana	Authenticates a Solana account with a service	Sign In with Solana

The format describes how the message is presented and signed. It does not guarantee that the requesting app or requested action is safe.

Confirm That You Initiated the Request

Before reviewing its contents:

1. Confirm that you intentionally opened the dApp and selected its sign, login, approve, or submit action.
2. Compare the requesting app and domain with the website visible in your browser.
3. Check that the request arrived immediately after the action you selected.
4. Cancel duplicate, delayed, or unexplained requests.

A familiar app name or logo is not enough. Verify the complete domain because a malicious website can copy both.

Review the Main Screen

Gem Wallet can display the requesting app, website, selected wallet, network, warnings, and decoded message fields. For supported approval messages, the top of the screen may also show the token and the exact or unlimited amount being authorized.

Verify each item:

• App and website — match the service you intentionally opened.
• Wallet — is the account you want to use.
• Network — matches the dApp and intended action.
• Asset and value — are expected and limited to what you intend.
• Spender or recipient — belongs to the intended protocol or counterparty.
• Expiration — is present and reasonable for the action.
• Warnings — do not describe an unexpected or dangerous permission.

Do not confirm just because the request contains no visible transfer amount. A signature can authorize a spender or create an order that another party submits later.

Open Details and the Full Message

For a structured request, select Details to inspect additional decoded fields. Gem Wallet can separate the most important fields from secondary technical information and can resolve supported addresses to recognizable names.

Select View Full Message when available and check for:

• An address, spender, contract, or verifying contract you do not recognize.
• An unlimited or unexpectedly large value.
• A deadline or expiration far beyond the current session.
• A different chain ID or domain.
• A batch containing more tokens or permissions than expected.
• A statement or resource link unrelated to the action you initiated.

Address labels improve readability but do not replace verification of the complete address.

Understand Gem Wallet Warnings

Gem Wallet can warn about conditions such as:

• Unlimited token approval.
• A regular wallet address receiving spender permission.
• Full NFT collection access.
• A suspicious spender.
• Invalid or mismatched structured-message data.

A critical warning disables the confirmation button. Do not attempt to bypass the block through another wallet or website. Non-critical warnings still require judgment; confirm only when you independently understand and trust the permission.

caution

The absence of a warning is not proof that a request is safe. New or obscure contracts may not yet have enough information for reliable classification.

Approve or Reject the Request

Select Confirm only when the request matches the exact action you initiated and every important field is understood. Gem Wallet may require your device authentication before signing.

Close or reject the request when:

• You cannot explain what the signature authorizes.
• The app, website, wallet, or network is wrong.
• The value, spender, contract, deadline, or resources are unexpected.
• A website claims signing is needed to receive an airdrop or release funds.
• Someone claiming to be support instructed you to sign.
• The request contains a warning you cannot independently resolve.

Rejecting a request does not sign the message or submit a transaction.

After Signing

Return to the dApp and confirm that only the expected action occurred. Review Gem Wallet activity and the relevant blockchain explorer when the signature was intended to create an approval, order, or transaction.

When you no longer need the connection:

1. Open Gem Wallet > Settings > WalletConnect.
2. Select the dApp connection.
3. Select Disconnect.

Disconnecting stops new session requests but does not invalidate a signature or revoke an approval already granted. Follow How to Revoke a Suspicious Token Approval when necessary.

If You Signed a Suspicious Request

1. Close the dApp and reject any new requests.
2. Disconnect its WalletConnect session.
3. Save the app domain and the message details without exposing private credentials.
4. Check the affected wallet for approvals and unexpected transactions.
5. Revoke suspicious allowances on the correct network.

Follow What to Do After Connecting to a Malicious dApp for the complete response. If you also exposed your Secret Phrase or private key, immediately follow the Secret Phrase exposure guide.

Signature Review Checklist

• Initiate the request yourself from a verified dApp domain.
• Match the app, wallet, and network.
• Verify the asset, value, spender, contract, and expiration.
• Open Details and View Full Message when available.
• Stop on critical, unexplained, or unexpected warnings.
• Remember that fee-free signing can still authorize asset access.
• Disconnect unused sessions and revoke unwanted approvals separately.