How an NFT is identified on-chain
The network, contract address and token ID help locate a specific NFT; display names and images are interface metadata and do not replace on-chain identifiers. An NFT is defined by a contract and on-chain record; names and images are presentation data, so network, contract address and token identifier are stronger verification anchors. For “How an NFT is identified on-chain,” first identify whether the relevant fact belongs to the local wallet interface, the selected network, or a contract permission. That distinction prevents an interface message from being mistaken for a final on-chain result.
DApp requests should be separated into account connection, message signing, transaction submission and token approval. They may appear consecutively, but their permissions and on-chain effects are different. In the context of “How an NFT is identified on-chain,” use a consistent order: establish the account and network, inspect the specific address, contract or request parameters, and only then authorize an action that can move assets or create permissions. Before confirming, review the domain, account, network, contract or recipient and any approval amount. If the purpose of the request cannot be explained, declining it is safer than treating connection as ongoing consent.
Within “How an NFT is identified on-chain,” a connection is only a session and does not pre-authorize asset actions. A message signature may prove account control, a transaction signature can change on-chain state, and a token approval can create persistent contract permissions; each deserves its own review.
- Verify the DApp domain and request source
- Distinguish connection, signing, transactions and approvals
- Inspect the contract or spender and permission scope
- Disconnect and review permissions when no longer needed
Building the check into routine use
If “How an NFT is identified on-chain” behaves differently from expected, record the active network, account, requester and any transaction hash, then eliminate possible causes one at a time. Do not keep signing, approving or sending assets merely to repair an issue that has not yet been identified.
NFT transfers still require network checks
The recipient, destination network and contract need the correct context, and a transfer can require gas and create an irreversible on-chain result. An NFT is defined by a contract and on-chain record; names and images are presentation data, so network, contract address and token identifier are stronger verification anchors. For “NFT transfers still require network checks,” first identify whether the relevant fact belongs to the local wallet interface, the selected network, or a contract permission. That distinction prevents an interface message from being mistaken for a final on-chain result.
DApp requests should be separated into account connection, message signing, transaction submission and token approval. They may appear consecutively, but their permissions and on-chain effects are different. In the context of “NFT transfers still require network checks,” use a consistent order: establish the account and network, inspect the specific address, contract or request parameters, and only then authorize an action that can move assets or create permissions. Before confirming, review the domain, account, network, contract or recipient and any approval amount. If the purpose of the request cannot be explained, declining it is safer than treating connection as ongoing consent.
Within “NFT transfers still require network checks,” a connection is only a session and does not pre-authorize asset actions. A message signature may prove account control, a transaction signature can change on-chain state, and a token approval can create persistent contract permissions; each deserves its own review.
- Verify the DApp domain and request source
- Distinguish connection, signing, transactions and approvals
- Inspect the contract or spender and permission scope
- Disconnect and review permissions when no longer needed
A pre-confirmation review
If “NFT transfers still require network checks” behaves differently from expected, record the active network, account, requester and any transaction hash, then eliminate possible causes one at a time. Do not keep signing, approving or sending assets merely to repair an issue that has not yet been identified.
NFT approvals and marketplace interactions
Some NFT actions require permission for a contract to manage one or several assets; verify the operator, scope and necessity before approving. An NFT is defined by a contract and on-chain record; names and images are presentation data, so network, contract address and token identifier are stronger verification anchors. For “NFT approvals and marketplace interactions,” first identify whether the relevant fact belongs to the local wallet interface, the selected network, or a contract permission. That distinction prevents an interface message from being mistaken for a final on-chain result.
DApp requests should be separated into account connection, message signing, transaction submission and token approval. They may appear consecutively, but their permissions and on-chain effects are different. In the context of “NFT approvals and marketplace interactions,” use a consistent order: establish the account and network, inspect the specific address, contract or request parameters, and only then authorize an action that can move assets or create permissions. When an interaction is finished, disconnect sessions that are no longer useful and review persistent approvals periodically. Revoking an old approval cannot undo a past transaction, but it can remove an unnecessary future permission.
Within “NFT approvals and marketplace interactions,” a connection is only a session and does not pre-authorize asset actions. A message signature may prove account control, a transaction signature can change on-chain state, and a token approval can create persistent contract permissions; each deserves its own review.
- Verify the DApp domain and request source
- Distinguish connection, signing, transactions and approvals
- Inspect the contract or spender and permission scope
- Disconnect and review permissions when no longer needed
How to verify the result
If “NFT approvals and marketplace interactions” behaves differently from expected, record the active network, account, requester and any transaction hash, then eliminate possible causes one at a time. Do not keep signing, approving or sending assets merely to repair an issue that has not yet been identified.
Unexpected NFTs and phishing links
An NFT or airdrop that appears automatically in a wallet is not necessarily trustworthy, especially when its description pushes an external link that asks for a connection or signature. An NFT is defined by a contract and on-chain record; names and images are presentation data, so network, contract address and token identifier are stronger verification anchors. For “Unexpected NFTs and phishing links,” first identify whether the relevant fact belongs to the local wallet interface, the selected network, or a contract permission. That distinction prevents an interface message from being mistaken for a final on-chain result.
Before confirming, review the domain, account, network, contract or recipient and any approval amount. If the purpose of the request cannot be explained, declining it is safer than treating connection as ongoing consent. In the context of “Unexpected NFTs and phishing links,” use a consistent order: establish the account and network, inspect the specific address, contract or request parameters, and only then authorize an action that can move assets or create permissions. When an interaction is finished, disconnect sessions that are no longer useful and review persistent approvals periodically. Revoking an old approval cannot undo a past transaction, but it can remove an unnecessary future permission.
Within “Unexpected NFTs and phishing links,” a connection is only a session and does not pre-authorize asset actions. A message signature may prove account control, a transaction signature can change on-chain state, and a token approval can create persistent contract permissions; each deserves its own review.
- Verify the DApp domain and request source
- Distinguish connection, signing, transactions and approvals
- Inspect the contract or spender and permission scope
- Disconnect and review permissions when no longer needed
Common mistakes and a better sequence
If “Unexpected NFTs and phishing links” behaves differently from expected, record the active network, account, requester and any transaction hash, then eliminate possible causes one at a time. Do not keep signing, approving or sending assets merely to repair an issue that has not yet been identified.