> For the complete documentation index, see [llms.txt](https://doc.lockerprotocol.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.lockerprotocol.com/reference/risk-warnings-explained.md). # Risk warnings explained Every warning the wallet can show, what it means, what to do. The extension and the Vault both analyze requests. Each finding has a reason. Here they are, in plain words. | Warning | What it means | What to do | | -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------- | | **The requesting site is on the bundled phishing list.** | The site's domain is a known scam. | Do not connect. Close the tab. | | **This domain uses unusual characters that can imitate another site.** | The address uses look-alike letters (punycode). | Type the real site's address yourself. | | **Grants an UNLIMITED spending allowance to a spender this device does not know.** | A contract you never used would get the right to move *all* of a token, forever. | Cancel. Look for an "approve exact amount" option on the site. | | **Grants an UNLIMITED spending allowance - the spender is on your allowlist, but the grant has no cap.** | Same, for a spender you used before. | Consider an exact amount; revoke afterwards. | | **Hands control of an ENTIRE collection to an operator this device does not know.** | `setApprovalForAll` on your NFTs to an unknown contract. | Cancel unless you are listing on a marketplace you trust. | | **Hands control of an ENTIRE collection to an allowlisted operator.** | Same, known operator. | Fine for known marketplaces; revoke when done. | | **The "token" being called has no contract code - a classic fake-token sign.** | The address is not a contract at all. | Cancel. It is a fake. | | **The displayed name does not resolve to the actual recipient address.** | The ENS name shown and the address in the transaction do not match. | Cancel. Someone is spoofing the name. | | **First interaction with this spender - never seen by this device before.** | Informational. | Double-check the site. | | **This moves or exposes nearly your ENTIRE balance of the token.** | Almost everything you own of this token is involved. | Make sure that is intended. | | **Delegates your account's code (EIP-7702) - your address will run the target's logic.** | Your address would start behaving like a contract. | Cancel unless you know exactly what the target is. | | **The payload is bound to a different chain than the one announced.** | The site says one network, the bytes say another. | Cancel. | | **This request matches an unusual pattern (local on-device analysis - advisory only).** | The local model found the request atypical. | Read everything twice; advisory only. | ## On the Vault The Vault's strip has four levels. **Green**: nothing to report. **Grey**: a call, program, Move call, contract type or operation is *not decoded on this device*, but the signing account, the network, the fees and what leaves the account were checked, and nothing alarming was found. **Orange**: read the findings. **Red**: a proven danger; **Sign** stays locked until you tick the acknowledgement. | Grey (not decoded, nothing to tick) | Red (proven danger, checkbox) | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | A function the Vault has no table for, on any chain. When it knows the contract it names it (Uniswap, 1inch, LI.FI, Aave, Lido, Seaport, Permit2, Jupiter, Raydium, Cetus, USDT, …) and the function called. | **UNLIMITED** token approval, **ACCOUNT DELEGATION (EIP-7702)**, **ACCOUNT HANDOVER** (Solana authority change, Tron permission change, Stellar merge), **CODE DEPLOYMENT** / package publish, a transaction smuggled inside a message, an **opaque** (unreadable) message, **Fee unknown** (Bitcoin), a recipient that could not be resolved, an unreadable tail in a batch. | Other Vault findings are advisory: **Durable nonce**, **Sponsored transaction**, **GASLESS TRANSFER AUTHORIZATION (EIP-3009)**, **Unknown Locker contract** (confirm the address, or register it under *My Lockers*). When in doubt, **Refuse**: nothing happens until you sign. ## Learn more * [Phishing & risk protection](/browser-extension/phishing-and-risk-protection.md) * [Sign a transaction (Vault)](/vault/sign-a-transaction.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://doc.lockerprotocol.com/reference/risk-warnings-explained.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.