How do you know if a MetaMask transaction is safe before signing?

Support
1

The truth is, you can’t be 100% sure, but you can significantly reduce your risk by taking a few extra steps to understand what you are signing.

Here are a few key things I always check before approving any transaction:

1. Make sure you are on the right website

Many wallet drain scams begin with fake websites that look almost identical to the official ones.

Ask yourself:

  • Is the domain name 100% correct?
  • Did I open the dApp from a bookmark or an official project link?
  • Is there anything suspicious or unusual about the URL?

2. Read the transaction details carefully

Review the expected actions before clicking confirm. Are you:

  • Swapping a token?
  • Approving a token allowance?
  • Signing a message?

Make sure the transaction details displayed match your intended action.

3. Pay close attention to token approvals

Before confirming, check:

  • Which token is being approved?
  • Which contract address is being granted approval?
  • Whether unlimited approval is being requested.

Note: Unlimited approvals may seem convenient, but they significantly increase your risk if the smart contract is ever exploited or turns out to be malicious.

4. Never ignore security warnings

Stop and investigate before continuing if MetaMask flags a transaction. However, keep in mind that the absence of a warning does not automatically mean the transaction is safe.

5. Be careful with signatures

Be cautious with off-chain signatures (e.g., eth_sign or permit signatures). If the transaction data is unclear or you don’t understand why you are being asked to sign, stop and investigate.

:clipboard: My Quick Checklist

  • Is the website domain correct?
  • Why is this transaction being requested right now?
  • What specific action is this transaction doing?
  • Is the contract/address correct and verified?
  • Are there any security warnings?
  • Is the approval allowance appropriate?

For more details, check out MetaMask’s Guide on Security Alerts.

What are the main things you always check before signing a MetaMask transaction?

2

Thanks for highlighting this all David, think it’s a great writeup & guide to transacting safely in MetaMask!

To answer your closing question, one thing I always check before signing a MetaMask transaction, is the amount of tokens being approved, or the outgoing tokens & receiving tokens. Think it’s really great that MetaMask offers this level of simulation, & is a great step for everyone to always take extreme caution with & make a habit out of.

3

Those are important things to always check before approving a transaction. And MetaMask is indeed really helpful with the various features to help users check some of these signals easily

4

Basic Wallet Security Practices

Now that security has been mentioned, I’d also like to add some basic security practices across different categories.

  • Browser & Extensions:

Always keep both your browser and wallet extensions up to date, and avoid installing unnecessary extensions. If possible, dedicate one browser specifically to wallet extensions and don’t install any other extensions on it.

Also, only download wallet extensions from official sources and be careful with fake extensions and phishing websites.

  • Transaction Signing:

I’m not promoting any particular product, but you can use security extensions such as Pocket Universe or Wallet Guard to double-check transactions before signing them. Keep in mind that some of these services may require a fee or have paid features, such as Pocket Universe.

Always review what you are signing, including the recipient, token approvals, permissions, and message signatures. If you don’t understand a transaction or signature, don’t sign it.

It’s also a good idea to regularly review and revoke token approvals that you no longer need.

  • Devices:

If possible, keep your crypto device separate from the device you use for everyday activities.

For example, if you have two devices, dedicate one specifically to crypto and avoid installing unnecessary applications on it. Ideally, keep it at home in a secure location instead of carrying it around with you.

The same applies to PCs. If you have a PC and a laptop, consider dedicating one of them to crypto.

Try to use a reputable antivirus/security solution and keep your operating system and software updated.

  • Wallets:

As a first priority, consider using a multisig wallet for significant holdings, and as a second layer, consider using a hardware wallet.

Try to keep your long-term holding wallet separate from your trading/transaction wallet. Your holding wallet should ideally never be connected to dApps.

For interacting with new or higher-risk dApps, use a separate hot/interaction wallet with only the funds you are willing to expose.

  • Secret Recovery Phrase:

Never share your Secret Recovery Phrase (SRP) or private key with anyone. Never enter it into a website, dApp, support chat, cloud storage, or online form.

Keep your backup offline and in a secure location. Avoid storing it as a screenshot or ordinary text file.

  • Diversifying Your Holdings:

For larger amounts, consider spreading your funds across multiple independent wallets instead of keeping everything in one wallet.

For example, if you have $10,000, you could use 10 separate wallets and hold approximately $1,000 in each.

Each wallet should ideally have a different SRP.

For even stronger security, you could use multiple multisig wallets and distribute your holdings between them.

If multisig isn’t practical for you, using multiple standard wallets with different SRPs can still reduce your single point of failure.

The goal is compartmentalization: if one wallet is compromised, your entire portfolio isn’t automatically exposed.

  • Phishing & Transfers:

Be careful with links received through Discord, Telegram, X, email, and DMs. Always verify the official domain before connecting your wallet.

Before sending large amounts, carefully verify the recipient address. For significant transfers, consider sending a small test transaction first.

Also remember that disconnecting a wallet from a dApp does not necessarily revoke token approvals.

No single security tool can protect you from every threat. A hardware wallet, multisig, antivirus, or security extension can reduce risk, but you still need to verify what you are signing.

The best security strategy is defense in depth: multiple independent layers rather than relying on one solution.