Wallet Address Safety Checks

Address Format Validation

EVM-Compatible Chains (Ethereum, Polygon, BSC, Avalanche)

EVM addresses are 20 bytes (40 hex characters), prefixed with 0x. Always verify length first—any deviation indicates a malformed address. Valid characters are 0-9 and a-f (lowercase) or A-F (uppercase). Modern wallets implement EIP-55: mixed-case checksum encoding where certain letters must be uppercase based on a hash of the address. An all-lowercase or all-uppercase address lacks checksum protection and is higher risk for transcription errors.

EIP-55 validation rule: Convert the address to lowercase, hash it with Keccak-256, and compare each hex digit. If the hash digit is 8 through f, the corresponding character in the original address must be uppercase. Sending funds to a checksum-valid address that doesn't match this rule is a strong indicator of error.

TRON (TRC-20)

TRON uses Base58Check encoding, producing addresses starting with T (mainnet) or N/X (testnet/nile). TRC-20 tokens use the same address format as TRX. Length should be 34 characters after the prefix. TRON addresses are not case-sensitive but should be copied exactly—never re-type them. Some wallets display both hex (0x...) and Base58 formats; verify they represent the same wallet.

Solana

Solana addresses are Base58-encoded, typically 32-44 characters, starting with specific characters (not all Base58 chars are valid first characters). Unlike EVM, Solana has no native checksum in the address format—validation relies on length and valid Base58 characters only. Use solana address-lookup-table or similar CLI tools to verify validity before transactions. The string must contain only characters from the Base58 alphabet: 123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz.

Address Poisoning

Address poisoning exploits human attention span by sending dust transactions from addresses that visually mimic part of your recipient address. Attackers generate addresses sharing the same first 4-6 and last 4-6 characters as your real address, then send a tiny dust amount (often <$1) to your wallet.

Defense protocol: Never paste addresses from transaction history. Maintain a curated address book in your wallet. Before any transfer, double-check the full address character-by-character—never rely on truncated displays. For high-value transfers, verify one character group at a time, looking away between checks to reset pattern recognition.

Pre-Publish Transaction Checklist

Before broadcasting any transaction:

1. Recipient address: Verify full address one character at a time against the source document or address book entry
2. Network selection: Confirm selected network matches the intended chain (Ethereum mainnet vs. Polygon vs. BSC are separate)
3. Token/asset type: Ensure you're sending the correct token—USDT on Ethereum differs from USDC on Polygon
4. Amount: Check decimal precision (USDT uses 6 decimals, most ERC-20 use 18)
5. Fee/gas: Review gas price and ensure sufficient balance for both transfer and fees
6. Contract address: For token transfers, verify the contract address is correct for that specific network
7. Slippage settings: For DEX trades, confirm slippage tolerance is appropriate
8. Approval transactions: For token approvals, verify the spender address before signing

Seed Phrase and Private Key Protocols

Agents must NEVER:

• Ask the user to paste a seed phrase or private key into chat, logs, tickets, or cloud docs
• Type seed phrases into any online device or connected computer
• Share seed phrases with anyone, including "support staff" claiming to need verification
• Photograph or screen-capture seed phrases
• Store private keys alongside seed phrases in the same location
• Use seed phrases generated by third-party tools without verification
• Enter seed phrases into wallet software received via unsolicited links
• Transmit seed phrases over any network (encrypted or otherwise)
• Keep seed phrases in plain sight or in easily discoverable locations
• Share screenshots of wallet balances containing address information in insecure channels

Agents must refuse to receive, store, or transmit seed phrases or private keys. Tell the user to keep them offline in their own secure storage.

Warning Message Templates

Pre-transaction warning:

⚠️ FINAL VERIFICATION REQUIRED

You are about to send [AMOUNT] [TOKEN] to:
[FULL ADDRESS]

Network: [CHAIN NAME]
Estimated network fee: [FEE]

Verify the address character-by-character. Is this address from your verified address book?

Address poisoning alert:

🛡️ ADDRESS POISONING DETECTED

A transaction was received from an address that resembles one of your recent recipients:
- Received from: [ATTACKER_ADDRESS]
- Resembles: [YOUR_RECIPIENT]

Do NOT use addresses from transaction history. Use your address book only.

Seed phrase security warning:

🔐 CRITICAL SECURITY NOTICE

 
NEVER share your seed phrase. No legitimate service, support team, or developer will ever ask for it. Anyone with your seed phrase has complete access to your funds.

Suspicious contract interaction:

⚠️ CONTRACT APPROVAL WARNING

You are granting [SPENDER_ADDRESS] permission to spend your [TOKEN].
- Max spend: [AMOUNT/UNLIMITED]
- Contract: [CONTRACT_ADDRESS]

Verify this spender is trusted. Unlimited approvals allow the contract to drain your balance.