On this page
NFTs are fundamentally on-chain recordsImages and names do not prove authenticityTransfers and approvals still require permission checksTreat unfamiliar airdrops and claim links cautiouslyNFTs are fundamentally on-chain records
In practice, NFTs are fundamentally on-chain records connects to several steps before and after the action itself. NFTs typically use smart contracts to record unique or semi-unique token ownership and metadata references. Names, images and collection pages can be imitated, so focus on the contract address, network, approval target and actual signature request rather than visuals alone.
A smart contract executes rules deployed on-chain. Wallets may show a readable summary, but complex interactions can include nested calls. For unfamiliar contracts, high allowances or requests you cannot understand, stop and verify through an independent source. Higher-value or higher-permission actions deserve an extra independent check, such as a second device, trusted bookmark or small test transaction.
A public blockchain records account, transaction and contract state across a network maintained by many nodes. Users do not need every low-level detail, but they should understand that on-chain records are publicly verifiable and confirmed transactions generally cannot be reversed by a wallet alone. Seed phrases, private keys and verification codes are never required as troubleshooting material and should not be shared with anyone.
Practical checks
- Verify the network, address or contract source relevant to nfts are fundamentally on-chain records.
- Confirm that the request matches the intended action instead of relying on a familiar label.
- Keep public identifiers such as transaction hashes for verification while keeping private credentials under your own control.
Images and names do not prove authenticity
Breaking Images and names do not prove authenticity into smaller decisions is more reliable than accepting a single page-level conclusion. NFTs typically use smart contracts to record unique or semi-unique token ownership and metadata references. Names, images and collection pages can be imitated, so focus on the contract address, network, approval target and actual signature request rather than visuals alone.
Token names and icons can be copied, so the contract address is a stronger identity check. When adding a custom token or handling an unfamiliar asset, verify the contract, network and token details from a trusted source rather than relying on a similar name. Before confirming, compare the active network, target and intended outcome together. If one of them does not match, stop and recheck rather than continuing out of habit.
Phishing pages often rely on lookalike domains, search ads, direct messages or fake promotions. Use a trusted entry point and verify the domain. A familiar logo, polished design or urgent warning does not make a site legitimate. A useful final test is to ask four questions: which network am I on, who am I interacting with, what permission am I granting, and what on-chain result should I expect?
What is easy to miss
- Verify the network, address or contract source relevant to images and names do not prove authenticity.
- Confirm that the request matches the intended action instead of relying on a familiar label.
- Keep public identifiers such as transaction hashes for verification while keeping private credentials under your own control.
Transfers and approvals still require permission checks
The easiest way to understand Transfers and approvals still require permission checks is to place it inside a real wallet workflow. A token approval allows a contract to spend a token under defined conditions. Excessive allowance or approval to the wrong contract increases exposure. Verify the spender, token, amount and purpose, and periodically revoke permissions that are no longer needed.
A signature proves that an account approved a message or transaction. Some message signatures do not transfer funds directly but can still authorize login or later actions. Before signing, review the recognizable domain, target, amount, permissions and any expiry. Order matters: verify the source and network first, then the address or contract, and only then review amounts, fees, signatures or permissions.
Permission scope determines what a third party can do and how much value is exposed. Distinguishing account visibility, message signing, transaction submission and token approval helps users avoid treating a low-impact connection like a high-impact authorization and makes suspicious requests easier to spot. Seed phrases, private keys and verification codes are never required as troubleshooting material and should not be shared with anyone.
Before you confirm
- Verify the network, address or contract source relevant to transfers and approvals still require permission checks.
- Confirm that the request matches the intended action instead of relying on a familiar label.
- Keep public identifiers such as transaction hashes for verification while keeping private credentials under your own control.
Treat unfamiliar airdrops and claim links cautiously
With Treat unfamiliar airdrops and claim links cautiously, one common mistake is treating interface text as the final on-chain truth. Malicious contracts or front ends can disguise approvals and signatures as claims, airdrops or account verification. Risk assessment should focus on the actual contract, permission scope and transaction effect rather than the marketing label shown on the page.
Phishing pages often rely on lookalike domains, search ads, direct messages or fake promotions. Use a trusted entry point and verify the domain. A familiar logo, polished design or urgent warning does not make a site legitimate. Higher-value or higher-permission actions deserve an extra independent check, such as a second device, trusted bookmark or small test transaction.
Disconnecting a DApp ends the current session but usually does not revoke token approvals already recorded on-chain. After an interaction, close sessions you no longer need and separately review any approvals that remain active. A useful final test is to ask four questions: which network am I on, who am I interacting with, what permission am I granting, and what on-chain result should I expect?
Make the checks repeatable
- Verify the network, address or contract source relevant to treat unfamiliar airdrops and claim links cautiously.
- Confirm that the request matches the intended action instead of relying on a familiar label.
- Keep public identifiers such as transaction hashes for verification while keeping private credentials under your own control.