In a post on /r/ledgerwallet I started writing some advices about how to protect your seed and your funds especially when using defi.

​

Who am I to give advices

I am what you could call a true defi degen.I have probably about 5000 nonce combined between the eth polygon arbitrum and cronos chains. In all those transactions there has been only once where I was fooled and got scammed out of my coins. (Story in the end for the curious)

​

Protect your seed

This one is easy, your seed gives access to all of your crypto so of course you need to protect it here is how I suggest to do it.

​

1. Use a hardware wallet (I use ledger but most hardware wallet will do it's a subject for another time)
2. Set up you hardware wallet the right way meaning:
3. Create the seed using the hardware wallet
4. Make backups of your seed only on paper or steel
5. The only digital device with your seed should be your hardware wallet (no photo, no email, no cloud services, only harware wallet paper or steel)
6. If you are confident enough to use it add a passphrase to your seed (also called 25th word) This makes it that someone finding your seed won't have access to your fund without this passphrase.

That's it for the hardware wallet part

​

Access defi app securely

There are several way to do it I use the brave browser and the metamask extension. The biggest mistake you can do here (and believe me /r/ledgerwallet is full of people who have done that) is to import your 24 words seed in metamask. That would defeat the whole purpose of having a hardware wallet.

​

The right way to do it is by using the Connect a hardware wallet function in metamask.

​

Access good dapps

It goes without saying but you are at the mercy of the dapps you decide to use so I am not going to tell you which dapp to use but at least gave you a few tools to check the app reputability:

• First thing is check if the dapp has an audit with respectable audit company like peckshield and stuff. Go through the audit report.
• You call also use other tools like https://rugdoc.io/ which do a good job assessing reliability of apps with doxing audit and other stuff
• Check the TVL of a protocol, it goes without saying that the more a dapp is handling fund the more trust in it people have

At this stage if you have setup your wallet, chosen a dapp. Every time you have to sign a transaction or a permit message in metamask you will need your hardware wallet to do so.

Which brings us to our next part which transactions to sign.

To sign or to not sign, this is the question.

There are several checks I do prior to pushing the buttons of my hardware wallet.

• Check that you are on the right URL

​

The biggest danger here is google sponsored adds that can be paid to appear first. Scammer will create a copy of the website but the transactions you would sign there would empty your wallet in no time.

​

https://preview.redd.it/0z2o4ozfnona1.png?675&format=png&auto=webp&s=e24ca69f257b40635d2e31f30bdc89213e6c3e32

​

To avoid this I find that bookmarking the sites that you use is a very good practice.

Also twitter can be a good source to get the right URL.

But ensuring that you are on the right URL is not enough the websites could have been defaced by hackers or a malware could be sitting on your machine that would modify the websites and transactions locally.

Once you are on your new defi app and you want to stake your XxX token. The first thing you will need to do is to approve the use of your tokens.

Token approval

On metamask the token approval screen will look like this

​

https://preview.redd.it/tpl4yh36oona1.png?418&format=png&auto=webp&s=952f10b4114cd56fe3e005ba9df7074c6cbd82ca

Here you have to check :

1. That the URL displayed is the one of the dapp that you are using
2. That the address you are giving your token approval to is the right one

I find there are two ways to do this :

• Most dapp will have a documentation or a gitbook where they will publish the address used in their dapp, you can use it to compare the address

​

https://preview.redd.it/gj9zjdwroona1.png?1856&format=png&auto=webp&s=226490274a1617639f2b7ef8b37f5d24865c01c5

• But also clicking on the second button next to the address will bring it up in your favorite block explorer like this:

​

https://preview.redd.it/s8j8y0yyoona1.png?1838&format=png&auto=webp&s=c52d69274a8353e521924339efdd7ee12e871ce1

Here there are several green flags that I look for prior to signing the approval transaction.

• The number of transactions which can be suspicious if too low
• The age of the first transaction and the creation of the contract which should be consistent with the age of the dapp
• Most dapp will publish the source code of their smart contract and get a green checkmark next to contract
• Some contract will also have a nickname in your block explorer here it is Radiant lending pool logic
• If I am feeling particularly paranoid (new dapp, etc...) I will also check some transactions. I will try to find one calling a method I find recognizable (withdraw/ claim reward, swap, etc..) and verify that the caller of the function got the token he was expecting in the transaction

The actual transaction

After having signed the approval the following transaction are less critical security wise. The danger really relies in the approval. But still I find that nicknaming the smart contract I interact with in metamask gives me peace of mind.

Metamask has an address book where you can save and nickname address.

https://preview.redd.it/o14bw0f9nona1.png?405&format=png&auto=webp&s=40a80ccdae9d2f21258ab89d07e98b9ec8e7ddf7

Here you can see that instead of displaying the address it says radiant vesting which tells me that this is a smart contract I already interacted with.

​

REVOKE REVOKE REVOKE

There use to be a better different time when contract were immutable, but this is not true anymore with the success of upgradable proxy. This means there is a possibility that the contract that was audited and you trusted could be changed entirely to a new one which would steal your funds.So once you are done using a contract try to revoke its token approval.

You can do so using one of those tools:

• https://revoke.cash/
• https://tin.network/
• most etherscan clone have this tool https://etherscan.io/tokenapprovalchecker

I like to use several as they are complementary to help identify which protocol is linked to the addresses you gave approval too.

​

Compartmentalize addresses

For privacy and security reason I find it smart to use several addresses.

I find it good to have you long term play/bags on different addresses which won't be at risk if you sign a bad approval.

Hack / Story time

For those that make it that far I will reward you with the story of how I got owned. (spoiler I did not respect my protocol)

I was regularly using a dex/farming platform on cronos called mmf. I day before doing a swap to change my MMF rewards to WBTC it asked me to approve the spending of mmf token.

Here I haf an afterthought that it was strange because I had claimed and swaped rewards several times on this dapp before so it should not ask me for the approval again.

I check that the URL of the website was right and it was so I assumed maybe they upgraded to a different contract.

So I go through with the approval even go through with the swap.But the swap transaction took my MMF but gave me 0 WBTC token in exchange.

Hours later the mmf telegram and twitter were explaining that their website was hack and defaced during a few hours.

I check on a block explorer and had I checked the contract on cronoscan before signing those transactions I would have realized that the contract was only a few hours old with only a few swap transaction that weren't sending the coins back.

The good thing is that since it was their website that got hack the mmf team came through and reimbursed every affected user so I was made whole.

​

PS:

There are a few more subject I would like to bring up:

• Approval permits which are like approval transaction in giving access to your wallets but are only signed messages which does not use gas and is not broadcasted to the blockchain (prior to being used).
• NFT security

But I feel like this post is long enough in itself so maybe this is for another time.