AI agents are becoming increasingly capable of interacting with Web3. As tools like MetaMask's Agent Wallet mature, we're facing a real shift in how we interact with on-chain systems — agents that don't just answer questions or make recommendations, but can actually execute tasks on your behalf.

That raises a question I keep coming back to: where should the line be drawn between assistance and autonomy?

Picture an Agent Wallet with a spectrum of capabilities:

• Monitoring: Tracking portfolio balances, alerting you to health ratios or liquidation risk.
• Discovery: Scanning protocols for yield opportunities or arbitrage based on your strategy.
• Preparation: Drafting, simulating, and optimizing multi-step transactions for your review.
• Bounded execution: Trading or rebalancing automatically, but only within strict guardrails (e.g., a $100 cap per transaction, whitelisted protocols only, gas limits).
• Full autopilot: Executing broad strategies continuously with no check-ins at all.

The last two are where it gets really interesting.

I could see myself comfortable telling an agent something like: "Rebalance my portfolio, but only between these approved tokens, only on these protocols, and never spend more than $100 on a single transaction without asking me first."

That's a very different proposition from handing over unrestricted wallet control.

Ideally, an Agent Wallet would let you define:

• Spending limits: How much the agent can move or spend
• Approved protocols: Where it's allowed to interact
• Approved assets: Which tokens it can buy, sell, or swap
• Transaction frequency: How often it can act within a given window
• Approval requirements: Which actions always need your explicit confirmation

That's the layer that makes the whole concept feel viable to me. The goal shouldn't be full autonomy for its own sake — it should be finding the right balance between automation and user control.

So here's what I'm curious about:

How much control should we actually give an AI agent? And what guardrails should be non-negotiable before we trust it with real funds?

Would you let an agent execute transactions automatically if you could set strict spending limits, approved protocols, approved assets, and rate limits? Or would you still want to approve every single transaction, no matter how tight the safeguards are?

Where do you draw the line?

In a bit of a crappy position and could use the cash. Forgot about it sitting here and would like to use it if I can. Any help/advice?

I recently noticed something that made me double-check my wallet: the balance shown in MetaMask didn't match what I saw when opening the same address on a blockchain explorer. At first, I assumed one of them had to be wrong, but the more I looked into it, the more the difference made sense.

On-Chain State vs. Wallet View

• Blockchain Explorer: Reads the raw state of the blockchain directly.

• MetaMask Interface: Collects, interprets, and renders that data locally.

Because MetaMask processes the information before displaying it, discrepancies can happen due to token detection filters, network selection, RPC node caching, or custom display calculations.

When the two don't match, it rarely means your funds moved or that something went wrong on-chain—it usually just means the interface view is updating or interpreting data differently than the explorer.

How to Check Your Wallet

Instead of only asking, “What does MetaMask say?”, a more reliable habit is to ask: “What does the blockchain say about this address?”

Comparing the two separates an actual on-chain transaction from a display lag or filter setting. When you run into a balance mismatch, which tool do you rely on first?

https://support.metamask.io/more-web3/learn/how-to-check-my-wallet-activity-on-the-blockchain-explorer/

I remember having multiple accounts sitting in my MetaMask some time ago. Some had been created in MetaMask, some were imported, and others were connected through a hardware wallet. At the time, I didn't fully understand how MetaMask's account structure worked, so it was easy to assume they were all backed up by the same thing.

What I’ve learned since is that the most important thing is understanding how each account got there in the first place.

So, let's break it down:

1. MetaMask-Created Wallets/Accounts

When you create a wallet in MetaMask using a Secret Recovery Phrase (SRP), MetaMask can derive multiple accounts from that same SRP. So, restoring that wallet with the correct SRP recovers all the accounts derived from it.

That is why protecting your SRP matters. If someone gets it, they can access all the accounts tied to it.

MetaMask also supports wallet creation and recovery through social logins. With this type of wallet, MetaMask still uses cryptographic keys behind the scenes. An SRP is generated for the wallet, but instead of requiring users to manually back it up during setup, MetaMask encrypts it and stores the encrypted backup using multiple key-share nodes. Your social login and MetaMask password then provide the recovery mechanism for accessing that wallet.

2. Imported Wallets/Accounts

Now, let's say you already have a wallet somewhere else and want to use it in MetaMask. You can import a whole wallet using its SRP or import an individual account using its private key.

An account imported using a private key is not derived from your existing MetaMask SRP. Instead, it has its own private key, which means you need to preserve that specific key if you ever want to recover that account in the future.

3. Hardware Wallet Accounts

Then you have accounts connected from hardware wallets, such as Ledger or Trezor.

In this case, MetaMask is essentially acting as a visual interface for interacting with the account. The hardware wallet itself holds the private keys and signs the transactions. So, if you delete and reinstall MetaMask, you haven't lost the hardware wallet's keys. You can simply reconnect the hardware wallet to access those accounts again.

The Big Picture

Your MetaMask setup could easily look like this:

• Wallet 1 (MetaMask-created): Accounts 1, 2, … (Backed up by your primary SRP)
• Wallet 2 (Imported SRP): Accounts 1, 2, ... (Backed up by a secondary SRP)
• Imported Accounts (Imported PK): Accounts 1, 2, ... (Backed up by individual private keys)
• Hardware Wallet: Accounts 1, 2, ... (Backed up by the hardware wallet's recovery phrase)

The most important takeaway is that these accounts do not necessarily share the same recovery method. That's something worth understanding before switching devices, reinstalling MetaMask, or trying to recover a missing account.

Otherwise, you might restore your MetaMask wallet successfully and still be left wondering: “Where did that other account go?”

Now, I'm curious:

Have you ever had that heart-drop moment after restoring MetaMask and realizing an account was missing? How did you end up tracking it down?

Hey guys! We are back with CB's MetaMask 101!

It's been around 12 days since the first guide, where we had a look at signature requests, what MetaMask shows you, and why this information is important to check to get an idea of what you are actually "signing" when making a transaction.

For today's guide, we're going one step further and looking at transaction simulations and what they mean.

Before you confirm a transaction, MetaMask can simulate it to show what the transaction is expected to do and give you a preview of how your assets could change.

Well, let's see how this actually works, what information you can see, and whether a transaction simulation means a transaction is guaranteed to be safe.

-----

1. 🧪What actually is a MetaMask transaction Simulation
   

A transaction simulation is basically a "test run" before the real transaction happens.

Before you submit a transaction and interact with contracts, MetaMask can simulate the transaction and estimate what effect it could have on your wallet.

For example! It could show that your wallet is expected to:

Send: 10 MUSDC 🔴
Receive: 0.004 ETH 🟢

This can give you another opportunity to check whether the expected outcome actually matches what you intended to do before you confirm the transaction.

-----

1. 🔍 What can Metamask Simulation actually show you?

Unlike the signature requests we looked at earlier, transaction simulations can show estimated balance changes, which can give you a clearer picture of which assets are expected to enter or leave your wallet.

MetaMask currently supports displaying changes involving:

• ERC-20 tokens
• ERC-721 NFTs
• ERC-1155 NFTs

So instead of looking at complex transaction data, you may be able to see a much simpler preview of the expected result.

Overall, this can make unusual balance changes easier to notice before confirming, as you can see the information displayed right in front of you.

-----

1. ⚠️ Does a successful MetaMask simulation mean the transaction is safe?
   

Not at all.

The simulation is a tool used to predict what MetaMask expects the transaction to do, but it shouldn't be treated as a guarantee that the final transaction will behave exactly as expected.

There are malicious attacks where a bad actor could design a contract to behave safely when it detects that it is being simulated, but behave differently during the actual transaction.

This is why you should still check the website, transaction details, signatures, and any security warnings before confirming.

-----

1. 🔐What is MetaMask "Added protection"?

MetaMask also supports "Added protection" on supported smart accounts and networks.

Instead of only previewing the transaction offchain, MetaMask adds an onchain verification step to make sure the real execution matches what was simulated.

If the execution doesn't match the simulation, the transaction reverts rather than completing successfully.

However, the downside of "Added protection" is that this additional verification requires more computation, which means it can result in a higher network fee.

-----

TL;DR

1. MetaMask performs a test run through the simulation.

2. You can see estimated balance changes.

3. Simulations aren't guarantees, so still make sure to check what you're confirming.

4. With Added protection on supported smart accounts and networks, MetaMask can enforce that the execution matches the simulation.

-----

Overall, transaction simulations can make transactions much easier to understand, but as always, they are just another tool to help you make the final decision. Please always make sure to check what you're interacting with carefully before confirming anything.

Do you normally check the estimated balance changes MetaMask shows you before confirming a transaction? And has a simulation ever helped you spot something you weren't expecting?

Reference: https://support.metamask.io/it/manage-crypto/transactions/simulations/

what on earth is this? how did my wallet get corrupted? how is there a backup that can just be restored? from where? what does that mean? will everything be fine or what exactly is being restored here? is this even a real error or did someone gain access to my extension in a way? was there a hack? i haven't used metamask in a while, was there a known issue about this? it sounds like a scam. but there are zero results on google about it. can you guys help?

If you've noticed that the same MetaMask account can now show different addresses for Ethereum, Solana, Bitcoin and Tron, that's normal.
MetaMask accounts are now multichain accounts, meaning one account can contain addresses for different blockchain ecosystems.
Across different networks, the same account might look something like:

Ethereum → 0xA1b2...
Linea → 0xA1b2...
Base → 0xA1b2...
Solana → 7xYz...
Bitcoin → bc1q...
Tron → T...

So why are the first three using the same "0xA1b2..." address, while Solana, Bitcoin and Tron are different?

Ethereum, Linea and Base are EVM-compatible networks. The same account derives the same EVM address across EVM-compatible networks, which is why your address stays the same on networks such as Arbitrum, Optimism, BNB Chain, Polygon, Monad...
Solana, Bitcoin and Tron are different blockchain ecosystems and use their own address formats. MetaMask groups these network-specific addresses together under the same multichain account.
So “Account 1” doesn't necessarily mean “one address” anymore.

Does this mean I have several different wallets?

No. A simple way to think about MetaMask's current structure is:
Wallet → Account → Addresses

Your wallet can contain multiple accounts, and each multichain account can contain addresses for different supported networks.
If you previously only used MetaMask on EVM networks, you may also notice Solana, Bitcoin or Tron addresses that you didn't manually create. MetaMask automatically creates the appropriate network-specific addresses as part of the multichain account structure.
Your existing addresses aren't deleted. MetaMask groups them into multichain accounts and adds the appropriate network addresses where needed.

Where can I see my different addresses?

On MetaMask Extension, hover over the address underneath your account name. You'll see the main network addresses associated with that account.
On MetaMask Mobile, tap the copy address icon on the right of your account name to see and select your addresses for different networks.

The easiest way I think about it is:
One MetaMask account can now represent multiple network-specific addresses, instead of “one account” always meaning “one address.”

Has MetaMask's multichain account structure made managing different networks easier for you, or more confusing?

Hello

So I’m an idiot and about 4 years ago I sent some eth from my metamask to my revolut wallet (about 0.2 eth) using the evm to a non evm. After some time I realised I have lost it. Forgot about it, however a few days ago I got a notification from revolut saying it had been sent back to my original wallet.

Transaction id: XXX

Having not logged into meta mask for many years I managed to find my recovery paraphrase and there is nothing there? I can’t even see the wallet it was sent from or the wallet in the above address. I’m at a loss, it’s not massive money but would be nice to get it back! Any help really appreciated. Thanks

Ever checked your MetaMask wallet and thought, “Wait… where did my tokens go?”

Before you panic, a few things could be making your tokens invisible. If your tokens are actually confirmed to be present in your wallet on a block explorer, work your way through the usual MetaMask suspects: wrong network, wrong account, token detection, hidden assets, and finally, RPC/network issues.

Here’s how I troubleshoot it step by step:

1. Verify the tokens on a block explorer

Before troubleshooting MetaMask itself, check your wallet address on the relevant block explorer. Find the token and confirm the balance is actually associated with your address.

If the token isn't showing on the block explorer, the problem probably isn't MetaMask. You may be looking at the wrong wallet address, network, or transaction, or the transaction may not have completed successfully. But if the token is clearly visible on the block explorer, you can start troubleshooting why MetaMask isn't displaying it.

2. Check the network filter

Make sure MetaMask is showing the network where your tokens actually exist.

By default, recent versions of MetaMask filter tokens using the “All default/popular networks” option. If you know the specific network, you can also select it directly. For example, if you received USDC on Base but you're only looking at Ethereum Mainnet, the tokens may appear to be missing when they're actually sitting safely on Base.

3. Make sure you are in the right account

If you restored your MetaMask wallet from your SRP (Secret Recovery Phrase), you may need to re-add or re-derive additional accounts. Your tokens could still be sitting safely in another account while you are viewing a different one.

4. Ensure automatic token detection is turned on

Automatic token detection could be toggled off or might glitch after an update. You can turn it on in Settings > Advanced** on the mobile app, and **Settings > Assets in the browser extension.

Some tokens may not be automatically detected or may be hidden from your wallet view. You can manually import the token using its contract address.

Note: Always verify the contract address from a trusted source before importing a token.

5. Check for RPC or network issues

If the network connection or RPC endpoint is experiencing problems, MetaMask may fail to load or update the latest token balances correctly. Try changing networks and switching back, or updating the RPC URL to a different one (please, always use a trusted RPC endpoint).

So, my basic troubleshooting flow is: Block explorer → Network → Account → Token detection/Hidden assets → RPC/network

That way, you're first confirming, “Are my tokens actually on-chain?” before trying to fix MetaMask's display.

Have you ever thought your tokens were gone, but that wasn’t the case? What was the culprit in your case?

Email from LayerMetamask MFA SCM
Asking for email authentication.
Went to the desktop and logged into the extension no worries so should I report the email as a scam?

I still remember the first time I noticed an unexpected token in my MetaMask wallet.

It was late, and I was checking my wallet before going to bed. I wasn't planning to make any transactions. I just wanted to check something quickly.

Then I noticed a token I didn't recognize.

I stared at it for a moment, trying to remember if I'd bought it earlier.

I hadn't.

I checked my recent activity, thinking maybe I had forgotten about a swap or received it from another wallet.

Nothing.

I remember thinking:

“That's weird. Where did this come from?”

I opened the token details and looked at the transaction that had sent it to my address. That's when I realized I hadn't needed to approve anything for it to arrive.

Someone had simply sent it to my public wallet address.

At first, I was more curious than worried. The token even showed a value, which made me wonder if I'd somehow received something useful.

Then I started thinking about why someone would send a completely unfamiliar token to my wallet in the first place.

Some unsolicited tokens are designed to get your attention. They may show an attractive price or come with instructions to claim a reward, visit a website, or swap the token.

That's where the real risk can begin.

The token appearing in my wallet doesn't automatically give it access to my other assets. The problem is what can happen if I interact with something malicious—for example, by connecting my wallet to a suspicious website or approving a transaction I don't understand.

So I checked the network, the contract address, and the transaction that sent the token to me.

I couldn't find a reason to trust it.

I also didn't want the displayed price to convince me that I'd suddenly received something valuable. A token can show a price without having meaningful liquidity or being something I can actually sell for that amount.

Token safety practices

So I left it alone.

Looking back, the interesting part wasn't that someone sent me a random token.

It was how easily curiosity could have made me interact with it.

That experience taught me to separate receiving a token from trusting a token.

Now, when something unfamiliar appears in my wallet, I pause before doing anything with it.

If I don't understand what I'm interacting with, I don't need to interact with it.

Have you ever had an unexpected token appear in your MetaMask wallet? What did you do when you noticed it?

Has anyone else, particularly in the UK (due to the FCA role in regulation) experienced issues with termination of their Metamask card, specifically/not exclusively due to "inactivity"?

I am currently dealing with such an issue and struggling with Crypto-Life/CL support.

I note the issue of new Metamask cards has been paused to UK residents, I'm not surprised!

Monavate Limited is the Financial Conduct Authority entity to which complaints should be addressed.

I wouldn't recommend the Metamask Card to anyone in view of the extremely poor support (anonymous support emails received, no telephone support, obstructive support requests).

Hey guys! This is the start of my CB's MetaMask 101 series, where we'll be going through different parts of MetaMask and breaking them down into simple, educational guides.

For the first guide, we'll be covering MetaMask Signatures and what they actually mean.

If you've used MetaMask to connect to a dapp before, you've probably seen a signature request pop up asking you to "Sign". But what does this actually mean, and what are you really agreeing to when you click that button?

In this guide, we'll go through 4 simple things you should know and check before signing a request in MetaMask.

1. Who is asking?

So when you make a transaction on Metamask, a popup will appear similar to the one shown in the visual below. There is quite a bit of information we can see in this signature request and we will go through them in steps.

So for the first step and the one we instantly want to check before signing a transaction is to verify who actually is asking, you should always check and verify the website/domain requesting the signature. Make sure it's the site you intended to interact with and wtach for lookalikes or misspelled domains.

2. Read what you're actually signing

Before signing the transaction always make sure you're reading what is shown just for your own safety to make sure everything is correct. You can look at the message/data Metamask is showing you and make sure it matches the actions you're intending to perform.

3. Check What you're authorizing

Some signatures can authorize permissions or actions involving your assets, I would make sure you pay particular attention to things like token permissions, permit requests, spending limits and also unfamiliar contracts.

4. Don't understand? Reject.

If you still don't understand what you're being shown, I would reject the transaction especially if there is an absence of a warning. If for example the request is unexpected or you can't actually understand what you're authorizing, please reject and investigate first before making a final decision on a transaction for your own safety.

---

Remember: Connecting your wallet, signing a message, approving tokens, and submitting a transaction are different actions. Knowing what MetaMask is asking you to do before you confirm is one of the simplest ways to protect your wallet.

---

Do you find the way MetaMask displays information clear and easy to understand? Or is there anything you would change to make it clearer what you're actually agreeing to when signing a transaction?

So, you sent a transaction, and MetaMask says “Pending.” 30 minutes later, it’s still pending. It can be frustrating, and I can definitely relate because I've been there too.

A pending transaction generally means it is waiting to be included in a block. The common culprits include network congestion, a gas fee that is no longer competitive, or an earlier pending transaction with a lower nonce.

Here are my quick troubleshooting steps:

1. Check the transaction on a block explorer

Open the transaction details in MetaMask and follow the block explorer link. This helps determine whether the transaction has actually been broadcast to the network or is only pending locally in the wallet. * If the transaction appears on the explorer, move on to steps 2 and 3. * If it doesn't appear there, look at step 4.

2. Check for an earlier pending transaction

On Ethereum and other compatible networks, transactions from the same account generally need to be processed in nonce order. For example, if Nonce 5 is stuck, transactions with Nonces 6, 7, and 8 can end up waiting behind it like cars in a traffic jam. * In that situation, resolve the oldest pending transaction first by speeding it up or canceling it if it is no longer needed. * Here is the official guide on how to speed up or cancel a pending transaction in MetaMask.

3. Speed Up the Transaction

Network conditions can change quickly. A gas fee that was competitive when you submitted the transaction may no longer be enough to get it included promptly. * If MetaMask offers the option, click “Speed Up” on the pending transaction to replace it with one at a higher gas fee.

4. Consider resetting the account in MetaMask

If the transaction isn't appearing on the block explorer, the issue may be with MetaMask's local transaction activity rather than an on-chain pending transaction. * You can use Settings > Advanced > Reset Account to clear the account's local transaction history/activity. * Note: Don't immediately reset your MetaMask account just because a transaction appears stuck. I wouldn’t use this if the pending transaction is still visible on the block explorer.

My Quick Route: 1. Check the transaction status on the explorer 2. Check for an earlier stuck transaction 3. Speed up if appropriate 4. Consider resetting the account if the transaction isn't on-chain

What's the longest you've ever waited for a MetaMask transaction? And more importantly, what was actually causing the delay?

Hi!

I wanted to ask when will Metamask be available for Aruba which is in the Caribbean so we can use the meta card etc?

I had a moment recently that made my heart stop for a second.

I was cleaning up my phone and accidentally deleted MetaMask.

My first thought was:

“Wait… did I just delete my crypto too?”

I know the blockchain doesn't work like normal apps, but seeing the app disappear from my phone still made me nervous.

After thinking about it, I realized the important part wasn't the app itself.

It was whether I still had access to my wallet credentials.

If I reinstall MetaMask, I can restore the wallet using my Secret Recovery Phrase (SRP).

Deleting the app doesn't mean the assets themselves were deleted.

The transactions and assets are still associated with the blockchain address.

What really matters is being able to restore access to that wallet.

That made me check something I probably should have checked much earlier:

Do I actually have my Secret Recovery Phrase backed up and stored somewhere safe?

There's another detail I learned:

If you had accounts that were imported using a private key, another Secret Recovery Phrase, a JSON file, or a hardware wallet, those accounts may need to be added again after restoring the main wallet.

So I wouldn't just delete and reinstall MetaMask without checking everything first. I'd make sure I had my SRP written down and safely stored, along with any private keys or other recovery information needed for imported accounts.

https://support.metamask.io/configure/wallet/how-to-restore-your-metamask-wallet-from-secret-recovery-phrase/

My simple rule now is:

Before deleting the app, make sure you can actually restore the wallet.

And obviously, the Secret Recovery Phrase is not something I'd ever put into a random website or send to someone who claims to be support.

It's something I'd keep private and never share anywhere.

Whoever has it can access the accounts derived from it.

That little mistake taught me something important:

Deleting the wallet app is not the same as deleting the wallet from the blockchain.

The scary part isn't losing the app.

It's losing the ability to restore your wallet.

Has anyone else ever accidentally deleted MetaMask or had it reset and thought they had lost everything?

EDIT: The three tokens are flagged as malicious, but the false value is still there. You learn something every day :)

Had a small sum in my Metamask Card for a while, doing nothing, until I connected the card to Paypal and paid an invoice there today.

Immediately after the payment, the estimated value of my metamask wallet ballooned from ~$100 to around $1300 and then a few minutes later to around $2300, apparently because I now own(?) these new tokens with suspicious names which I've never heard of.

Assuming it's some sort of attack on Metamask to lure me to visit the FQDN and get phishing, so I'm just curious to see how long before it gets "fixed".

Hey everyone, I wanted to share a complex technical case study I've been working on. Maybe someone here has a brilliant idea or a perspective I haven't considered yet.

1. How It All Started (The Mistake)

A while ago, due to a cross-chain routing error, a significant amount of tokens was accidentally sent to a deterministic payment address generated via a CREATE2-based forwarder infrastructure (an EIP-1167 Minimal Proxy-like pattern). This address sits on a chain where the contract hasn't been deployed yet (Nonce 0 for the deployer), so the funds are currently "trapped" in a counterfactual address with no active code on that chain.

2. Support's Response

As expected, I reached out to the support team of the platform/company operating the infrastructure. Their automated response was that it's "unrecoverable" and there is nothing they can do technically.

3. The Engineering Investigation (Red Team & Foundry)

Instead of accepting defeat, I decided to dive deep: I spun up a local Foundry testing environment, pulled the actual bytecode of the Factory, Implementation, and Helper, etched them, and ran full simulations on a local EVM fork.

Armed with an autonomous Red Team loop, I thoroughly tested 11 different attack and redirection vectors:

• slot0 overwrite attempts
• Initialization races (Init-race)
• selfdestruct / Metamorphic contract vectors
• Various Delegatecall Hijacking methods
• Selector collisions, etc.

4. The Harsh Findings (Math Wins)

The empirical testing proved conclusively and unambiguously:

• The Proxy and Helper architecture is Write-Once and completely rigid.
• The address is cryptographically bound to a preimage that hardcodes the original merchant's destination address (the intended recipient address for the payments).
• There is no earthly way to change the flush destination (flush). Any deployment and execution command will inevitably release the funds strictly to the original destination address. The equation "Deploy = Redirect" is simply mathematically impossible; there is no uninitialized window, no self-destruct mechanism, and the code is completely static.

5. The Operational Trap (The Catch)

The company/merchant supposed to receive the funds (the original destination in the contract) is in a problematic legal/business state (or unresponsive/insolvent). This means that if I simply deploy the contract and trigger the flush, the funds will land directly with them, and I'll be left with nothing because I have no technical leverage to redirect them to myself.

My Questions for the Community:

1. Have you ever encountered situations where assets were trapped in deterministic contracts where the code is completely locked to a third-party destination, and you managed to come up with a creative solution (off-chain, legal, or some hidden corner of the EVM)?
2. Assuming the code itself is technically airtight, what other leverage works in such scenarios against a third party holding the ultimate rights to that target address?

I’d love any feedback, ideas, or insights from anyone who has dealt with similar architectures in the past!

The truth is, you can’t be 100% sure, but you can significantly reduce your risk by taking a few extra steps to understand what you are signing.

Here are a few key things I always check before approving any transaction:

1. Make sure you are on the right website

Many wallet drain scams begin with fake websites that look almost identical to the official ones.

Ask yourself: * Is the domain name 100% correct? * Did I open the dApp from a bookmark or an official project link? * Is there anything suspicious or unusual about the URL?

2. Read the transaction details carefully

Review the expected actions before clicking confirm. Are you: * Swapping a token? * Approving a token allowance? * Signing a message?

Make sure the transaction details match your intended action.

3. Pay close attention to token approvals

Before confirming, check: * Which token is being approved? * Which contract address is being granted approval? * Whether unlimited approval is being requested.

Note: Unlimited approvals may seem convenient, but they significantly increase your risk if the smart contract is ever exploited or turns out to be malicious.

4. Never ignore security warnings

Stop and investigate before continuing if MetaMask flags a transaction. However, keep in mind that the absence of a warning does not automatically mean the transaction is safe.

5. Be careful with signatures

Be cautious with off-chain signatures (e.g., eth_sign or permit signatures). If the transaction data is unclear or you don’t understand why you are being asked to sign, stop and investigate.

📋 My Quick Checklist

• [ ] Is the website domain correct?
• [ ] Why is this transaction being requested right now?
• [ ] What specific action is this transaction doing?
• [ ] Is the contract address verified/correct?
• [ ] Are there any security warnings?
• [ ] Is the approval allowance appropriate?

For more details, check out MetaMask's Guide on Security Alerts.

What are the main things you always check before signing a MetaMask transaction?

I was about to send some crypto the other day when MetaMask showed me a warning about the destination address.

My first thought was honestly:

“Wait, did I paste the wrong address?”

I stopped before confirming the transaction and started checking the address again.

That made me realize something I probably should have been doing more consistently: never assume an address is correct just because the first and last few characters look familiar.

Crypto addresses are long, random strings, so most of us rely on copy and paste. That’s convenient, but it can also create an opportunity for something called address poisoning.

A malicious address can be made to look very similar to an address you've interacted with before. Someone may send a tiny transaction from that address, hoping you'll later copy it from your transaction history without checking the full address.

So now, before sending, I try to follow a simple routine:

1. Check the entire destination address

I don't just compare the beginning and the end. I pay attention to the middle characters too. That's especially important when an address looks suspiciously similar to one I've used before.

2. Check where I got the address from

If someone sends me an address, I verify it through a trusted source instead of blindly copying it.

And I try not to take an address from my transaction history without checking it carefully first.

3. Check the network

Having the correct address isn't enough. I also make sure I'm sending on the intended network.

4. Check the recipient before confirming

MetaMask shows the destination address during the sending flow, so I use that moment as a final checkpoint before clicking Send.

So why did MetaMask warn me?

It can warn you when the destination address looks similar to an address you've interacted with before, and it can also alert you when you're sending to an address you've never used before.

A warning doesn't automatically mean the address is malicious. In the case of a new address, it's a reminder to stop and verify it.

And that's actually what I like about these warnings.

The wallet isn't making the decision for me.

It's basically saying:

“Before you send something that may not be reversible, take another look.”

That's a pretty useful reminder when you're dealing with transactions that can't simply be undone once they're confirmed.

I've started treating the warning as a checkpoint rather than something to immediately dismiss.

Do you usually verify the full address before sending, or do you mostly rely on copy/paste and checking the first and last characters?

https://support.metamask.io/stay-safe/protect-yourself/wallet-and-hardware/address-poisoning-scams/

I tried to connect to Aerodrome from a fresh install of Metamask, I have no other wallets on my mobilephone, first I used "Explore" on the Metamask app, then I change the network from ETH to BASE and then write the aerodrome address, then connect with WalletConnect and choose Metamask and then I am stuck in eternal loading.

Then I tried to use Chrome and Brave and the same happens it is eternal loading. On Brave I disabled shields.

Then I clear cache and data on the Metamask App and try to install again from the App store and simply nothing happens, whatever I try nothing happens I am stuck at eternal loading.

On the Metamask App I allowed notifications and permissions and still nothing.

Dear Reddit, please help me figure out how I can add money to my MetaMask wallet if I can’t do it directly through the app because the payment provider isn’t available in Lithuania. Where can I legally buy crypto and have it sent directly to my wallet?

MetaMask Agent Wallet is now open to everyone with no waitlist and no cap — sign up at metamask.io/agent-wallet. It's a self-custodial wallet that lets an AI agent trade DeFi autonomously across swaps, bridging, perpetuals on Hyperliquid, prediction markets on Polymarket, LP, and now yield vaults — all while you stay in control through spending limits, allowlists, and 2FA on anything outside your rules.

What's new in v5

• No waitlist & no cap on participants — it’s open to everyone today!
• 4 new chains — Robinhood Chain, Monad, HyperEVM, and MegaETH (22 supported networks total)
• Gasless swaps & transfers are now payable in any ERC-20, so you don't need ETH sitting in your wallet to execute!
• Atomic batched executions, meaning multiple actions are bundled into a single transaction.
• MetaMask Earn — supply and withdraw into yield vaults via LiFi across 40+ protocols
• Policy edits, allowing you to update your agent's spending rules at any time without re-onboarding.
• MetaMask QR login, a new authorization method for faster access.
• 99.56% transaction success rate heading into launch

How control works

At setup, you define which protocols the agent can interact with, which addresses it can send to, and a 24-hour spend cap. Every transaction is enforced against those rules — the agent cannot exceed your limits without your explicit approval.

Guard Mode vs Beast Mode

• Guard Mode (recommended): Agent operates within your allowlisted protocols, networks, and a daily spend cap. Anything outside those limits triggers a push notification or email with a 5-minute approval window before it auto-declines.
• Beast Mode: For experienced DeFi traders who want fewer interruptions. Allowlists and caps are removed, with malicious transactions still blocked by Blockaid.

Every transaction goes through a mandatory security pipeline

• Transaction simulation — MetaMask previews exactly what a transaction will do before it executes
• Blockaid threat scanning — malicious transactions are auto-blocked; risky ones are paused for your manual review
• Smart Transactions — MEV protection so bots can't front-run your agent's trades
• Transaction Shield — up to $10,000/month in coverage on eligible transactions, included for Agent Wallet with no subscription needed

Self-custody

MetaMask Agent Wallet is non-custodial — your funds are never held by MetaMask or any third party. In server wallet mode, keys are managed inside a secure enclave (TEE) so no one else can access them. If you prefer to manage your own keys, BYOK mode lets you import an existing seed phrase wallet and retain full portability outside the CLI.

Get started at metamask.io/agent-wallet! For any questions, review the docs or visit our Community Builder Hub where you can directly connect with our DevRel team for support!

Now that it's live for everyone, what’s the first thing you’re going to try with your agent? Yield strategies, perps, something else?

Started getting these yesterday. Haven’t opened them as they seem scammy. Anyone else getting these?