Connecting to dApps

WalletConnect from a paper wallet, how SWOP decodes a signature request before you approve it, and which requests to reject.

DApps connects SWOP to a website through WalletConnect, so you can use decentralised applications — staking, presales, swaps, marketplaces — while the private key stays on your computer.

This is the part of SWOP that closes the gap self-custody normally leaves. A wallet on a printed card can hold funds perfectly well and can do nothing else, because every application on the web expects a browser extension holding your key. SWOP connects on the card's behalf.

How it works

1. Open the wallet with your private key or recovery phrase, on the network you intend to use.
2. On the website, choose to connect with WalletConnect. It shows a QR code or gives you a URI.
3. Scan that QR with your phone through SWOP Scan, or paste the URI into SWOP.
4. SWOP pairs with the site and shows you its connection request.
5. Approve it, and the site sees your public address.

From that point the site can ask you to sign things. Every request comes to SWOP, and nothing is signed without you approving it individually.

Connected sites are listed under Connected dApps, and can be disconnected from there.

Reading what you are being asked to sign

This is the section that matters, and the reason SWOP shows more than a browser wallet does.

Most losses in self-custody are not broken cryptography. They are a person approving a request they did not read, on a site they reached through a link, and the request being exactly what it appeared to be — a legitimate, valid, correctly signed instruction to let someone else move their tokens.

So SWOP decodes the request instead of showing raw hex. For each one it shows the method, the destination, the value, the network and the data, and where it recognises the call it explains in plain terms what approving it would do:

approve — lets another address spend that token out of your wallet. If the spender is not the site you are actually using, reject it.

setApprovalForAll — hands over control of every NFT you hold in a collection. It is the single most common way NFTs are taken.

permit — a signature rather than a transaction, costing no gas, that still authorises spending your tokens. The absence of a fee makes it feel harmless, and a large share of scam flows rely on exactly that.

Permit2 — the same kind of authorisation routed through the Permit2 contract. Check who receives it and for how much.

Marketplace orders — a signature that creates an order which can sell your NFTs or tokens. Check the price on the site before signing, because the signature carries the price, not the site.

transferFrom — moves tokens between wallets. Check both the source and the destination.

Unrecognised calls — SWOP says plainly that it cannot read the call, rather than implying it is fine. Approve only something you started yourself, on a site you trust.

Unlimited approvals

When a request grants unlimited spending, SWOP marks it UNLIMITED and requires you to tick a separate confirmation before you can approve. One extra deliberate action, on the specific class of request that causes the most damage.

An unlimited approval does not expire. It stays valid for as long as the token contract exists or until you revoke it, which is why the website's Health & security view lists open approvals — including ones granted years ago to a protocol you used once.

eth_sign is disabled

eth_sign signs arbitrary data with no context about what the data means. There is no way to present it safely, and no legitimate application needs it. SWOP does not support it at all.

Which requests to reject

Reject anything that does not match what you just did on the site. Specifically:

• A signature request you did not trigger
• Unlimited permissions, unless you understand precisely why the site needs them
• A network switch you did not ask for
• A PSBT you cannot account for
• A destination or amount that differs from what the site displayed

Rejecting costs nothing. Every request can be made again.

Network

The network selector applies here too. WalletConnect sessions are bound to a chain, and a site asking to switch networks mid-session is a thing to notice rather than approve automatically.

Connection problems

WalletConnect runs over a relay at wss://relay.walletconnect.com. When SWOP cannot subscribe or connect, the usual cause is a firewall or network blocking that address.

QR codes and URIs expire. If a pairing fails, generate a fresh one on the site rather than reusing the old code.

Staking and presales

These are contract interactions like any other, which is the point: a staking deposit is a transaction to a contract, and a presale is a transaction to a contract. Nothing about SWOP treats them specially.

What it does mean is that a paper wallet can participate in them. Read the request the same way you would read any other, and treat the contract address itself as something to verify — a presale is only as good as the address you are sending to.