imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.

imtoken

Signature Requests & Risk Review

Distinguish message signatures, transaction signatures and contract interactions, and learn what to inspect before signing.

On this pagemessage signaturestransaction signaturescontract callsstop when details are unclearhandling suspicious signing requests

Signature Requests & Risk Review: Distinguish message signatures, transaction signatures and contract interactions, and learn what to inspect before signing. Wallet security is built through repeatable habits rather than a single setting. When facing a signature, approval, transfer or recovery request, protecting sensitive information and reviewing details should come before convenience.

Security principle: In Signature Requests & Risk Review, imtoken does not ask users to enter a seed phrase, private key or wallet recovery phrase.
Offline backup and private key protection

message signatures

Check 1

When working with message signatures, place the concept back into a real transaction flow. Information on screen may come from on-chain state, local wallet records or a third-party page, so verify public details such as the network, address, transaction hash or contract before deciding what to do next.

Check 2

In Signature Requests & Risk Review, the section on message signatures connects directly to the page’s main task. Connecting to a DApp usually allows the site to request account information or initiate actions. It does not mean later signatures or approvals should be accepted automatically. Review every request separately, especially transfers, allowance scope and contract addresses.

Within Signature Requests & Risk Review, for message signatures, keep the decision reversible for as long as possible: verify information first, then authorize only the minimum action needed. If the request changes the network, transfers an asset, grants spending permission or interacts with a contract, review the exact target and expected result before confirming.

In Signature Requests & Risk Review, a good outcome for message signatures is not simply that an interface reports success. The useful evidence is whether the expected on-chain state appears on the correct network, under the correct address or contract, and with a transaction or permission record that matches the intended action.

transaction signatures

Check 1

A common mistake with transaction signatures is drawing a conclusion from a single field. A stronger check compares the active network, destination, asset identity and on-chain record together, especially for same-named tokens, cross-network activity or DApp interactions.

Check 2

In Signature Requests & Risk Review, the section on transaction signatures connects directly to the page’s main task. Connecting to a DApp usually allows the site to request account information or initiate actions. It does not mean later signatures or approvals should be accepted automatically. Review every request separately, especially transfers, allowance scope and contract addresses.

Within Signature Requests & Risk Review, for transaction signatures, keep the decision reversible for as long as possible: verify information first, then authorize only the minimum action needed. If the request changes the network, transfers an asset, grants spending permission or interacts with a contract, review the exact target and expected result before confirming.

In Signature Requests & Risk Review, a good outcome for transaction signatures is not simply that an interface reports success. The useful evidence is whether the expected on-chain state appears on the correct network, under the correct address or contract, and with a transaction or permission record that matches the intended action.

contract calls

Check 1

For contract calls, a useful review pattern is source, scope and result. Source explains where the request came from; scope shows what the action can affect; result is then checked through transaction records, block confirmations or approval state.

Check 2

In Signature Requests & Risk Review, the section on contract calls connects directly to the page’s main task. Connecting to a DApp usually allows the site to request account information or initiate actions. It does not mean later signatures or approvals should be accepted automatically. Review every request separately, especially transfers, allowance scope and contract addresses.

Within Signature Requests & Risk Review, for contract calls, keep the decision reversible for as long as possible: verify information first, then authorize only the minimum action needed. If the request changes the network, transfers an asset, grants spending permission or interacts with a contract, review the exact target and expected result before confirming.

In Signature Requests & Risk Review, a good outcome for contract calls is not simply that an interface reports success. The useful evidence is whether the expected on-chain state appears on the correct network, under the correct address or contract, and with a transaction or permission record that matches the intended action.

stop when details are unclear

Check 1

stop when details are unclear is not only a feature label; it also has a specific risk boundary. If a page conflicts with the wallet display or the request cannot be explained clearly, stop before signing, approving or transferring and verify through trusted public information.

Check 2

In Signature Requests & Risk Review, the section on stop when details are unclear connects directly to the page’s main task. Connecting to a DApp usually allows the site to request account information or initiate actions. It does not mean later signatures or approvals should be accepted automatically. Review every request separately, especially transfers, allowance scope and contract addresses.

Within Signature Requests & Risk Review, for stop when details are unclear, keep the decision reversible for as long as possible: verify information first, then authorize only the minimum action needed. If the request changes the network, transfers an asset, grants spending permission or interacts with a contract, review the exact target and expected result before confirming.

In Signature Requests & Risk Review, a good outcome for stop when details are unclear is not simply that an interface reports success. The useful evidence is whether the expected on-chain state appears on the correct network, under the correct address or contract, and with a transaction or permission record that matches the intended action.

handling suspicious signing requests

Check 1

After completing an action involving handling suspicious signing requests, review the outcome again. Transaction status, approval targets, network confirmations and balance changes are stronger evidence than a page-level success message alone.

Check 2

In Signature Requests & Risk Review, the section on handling suspicious signing requests connects directly to the page’s main task. Connecting to a DApp usually allows the site to request account information or initiate actions. It does not mean later signatures or approvals should be accepted automatically. Review every request separately, especially transfers, allowance scope and contract addresses.

Within Signature Requests & Risk Review, for handling suspicious signing requests, keep the decision reversible for as long as possible: verify information first, then authorize only the minimum action needed. If the request changes the network, transfers an asset, grants spending permission or interacts with a contract, review the exact target and expected result before confirming.

In Signature Requests & Risk Review, a good outcome for handling suspicious signing requests is not simply that an interface reports success. The useful evidence is whether the expected on-chain state appears on the correct network, under the correct address or contract, and with a transaction or permission record that matches the intended action.

Important risk reminder

For Signature Requests & Risk Review, Remember: the user is responsible for safeguarding the seed phrase and private keys, and official staff will not ask for a seed phrase, private key or verification code. On-chain transactions generally cannot be reversed by a wallet alone, and third-party DApps or smart contracts may involve technical or fraud risks. Review the address, network, amount, approval target and permission scope before acting.

Related reading

Continue with imtoken

Continue from the imtoken download entry after reviewing the key checks in Signature Requests & Risk Review.

Download imtoken