Security Checklist for Web3 Frontend Developers

Frontend security in Web3 protects users from phishing, transaction manipulation, and data theft. Use this checklist to secure your dApp.

Web3 Frontend Developer

67 items

Updated May 17, 2026

0 of 67 completed (0%)

Wallet Connection Security

Never request more permissions than needed from wallets

critical

Handle wallet disconnection gracefully without crashes

critical

Validate wallet address format before using

critical

Support multiple wallets, not just MetaMask

important

Detect and handle network/chain switching

critical

Show clear UI states for connecting, connected, and disconnected

important

Persist connection state appropriately (don't reconnect without consent)

important

Handle wallet extension conflicts gracefully

nice-to-have

Transaction Security

Signature Security

Use typed data signing (EIP-712) instead of raw message signing

critical

Display human-readable message content before signing

critical

Include domain separator in typed data to prevent replay attacks

critical

Add nonces to signatures to prevent reuse

critical

Include expiry timestamps in time-sensitive signatures

important

Never sign messages containing raw transaction data

critical

Validate signature requests come from your own frontend

critical

Input Validation

Sanitize all URL parameters before use

critical

Validate address inputs match expected format (checksummed)

critical

Validate amount inputs are positive numbers

critical

Check for integer overflow in amount calculations

critical

Validate token decimals match expected values

critical

Sanitize ENS names before resolution

important

Validate contract addresses exist and have code

critical

Escape special characters in user-provided data

critical

Data Protection

Never store private keys in frontend code or storage

critical

Do not store sensitive data in localStorage

critical

Clear sensitive data from memory after use

important

Use HTTPS for all API calls

critical

Validate SSL certificates for RPC endpoints

critical

Do not log sensitive transaction data

critical

Implement proper error handling to avoid leaking stack traces

important

Phishing Protection

Verify contract addresses against known good addresses

critical

Display clear warnings for unknown contracts

critical

Show full destination addresses, not just truncated versions, for large transactions

important

Implement address book for frequent recipients

nice-to-have

Warn about address poisoning attacks

important

Display ENS verification alongside addresses

important

Check token contracts against known scam lists

important

Error Handling

Implement error boundaries to prevent full app crashes

critical

Handle RPC errors gracefully with retry logic

critical

Display user-friendly error messages, not raw errors

important

Log errors for debugging without exposing sensitive data

important

Handle network timeouts with appropriate fallbacks

important

Implement circuit breakers for failing services

nice-to-have

Dependencies and Build

Audit npm packages for known vulnerabilities (npm audit)

critical

Lock dependency versions to prevent supply chain attacks

critical

Use integrity hashes for CDN resources

important

Review dependency code for wallet or key handling

important

Implement Content Security Policy headers

critical

Avoid using eval() or innerHTML with user data

critical

Minify and obfuscate production builds

nice-to-have

Testing

Test with real wallets on testnets, not just mocks

critical

Test mobile wallet browser behavior

critical

Test with slow network conditions

important

Test transaction failures and reverts

critical

Test wallet disconnection mid-transaction

important

Test with multiple browser extensions installed

nice-to-have

Implement E2E tests with wallet automation (Synpress)

important

Key Recommendations

Test wallet flows on actual mobile devices, not just responsive browser views.

Use transaction simulation (Tenderly, Blowfish) before every on-chain action.

Cache RPC responses aggressively. Users notice slow dApps.

More Guides for Web3 Frontend Developers

Checklist

Dapp Launch Checklist for Frontend Developers

Project Ideas

55 Portfolio Project Ideas for Web3 Frontend Developers

Common Mistakes

30 Common Mistakes Web3 Frontend Developers Make (And How to Avoid Them)

Tools Directory

34 Essential Tools for Web3 Frontend Developers

Looking for Web3 Opportunities?

Explore curated, high-impact roles across top blockchain protocols and Web3 startups.

Back to All Resources

Security Checklist for Web3 Frontend Developers

Wallet Connection Security

Transaction Security

Signature Security

Input Validation

Data Protection

Phishing Protection

Error Handling

Dependencies and Build

Testing

Key Recommendations

More Guides for Web3 Frontend Developers

Related Reading

Looking for Web3 Opportunities?