Security Checklist for Web3 Frontend Developers

Frontend security in Web3 protects users from phishing, transaction manipulation, and data theft. Use this checklist to secure your dApp.

For: web3 frontend developer•Updated: March 13, 2026

0 of 67 complete

Wallet Connection Security

Never request more permissions than needed from walletscritical

Handle wallet disconnection gracefully without crashescritical

Validate wallet address format before usingcritical

Support multiple wallets, not just MetaMaskimportant

Detect and handle network/chain switchingcritical

Show clear UI states for connecting, connected, and disconnectedimportant

Persist connection state appropriately (don't reconnect without consent)important

Handle wallet extension conflicts gracefullynice-to-have

Transaction Security

Signature Security

Use typed data signing (EIP-712) instead of raw message signingcritical

Display human-readable message content before signingcritical

Include domain separator in typed data to prevent replay attackscritical

Add nonces to signatures to prevent reusecritical

Include expiry timestamps in time-sensitive signaturesimportant

Never sign messages containing raw transaction datacritical

Validate signature requests come from your own frontendcritical

Input Validation

Sanitize all URL parameters before usecritical

Validate address inputs match expected format (checksummed)critical

Validate amount inputs are positive numberscritical

Check for integer overflow in amount calculationscritical

Validate token decimals match expected valuescritical

Sanitize ENS names before resolutionimportant

Validate contract addresses exist and have codecritical

Escape special characters in user-provided datacritical

Data Protection

Never store private keys in frontend code or storagecritical

Do not store sensitive data in localStoragecritical

Clear sensitive data from memory after useimportant

Use HTTPS for all API callscritical

Validate SSL certificates for RPC endpointscritical

Do not log sensitive transaction datacritical

Implement proper error handling to avoid leaking stack tracesimportant

Phishing Protection

Verify contract addresses against known good addressescritical

Display clear warnings for unknown contractscritical

Show full destination addresses, not just truncated versions, for large transactionsimportant

Implement address book for frequent recipientsnice-to-have

Warn about address poisoning attacksimportant

Display ENS verification alongside addressesimportant

Check token contracts against known scam listsimportant

Error Handling

Implement error boundaries to prevent full app crashescritical

Handle RPC errors gracefully with retry logiccritical

Display user-friendly error messages, not raw errorsimportant

Log errors for debugging without exposing sensitive dataimportant

Handle network timeouts with appropriate fallbacksimportant

Implement circuit breakers for failing servicesnice-to-have

Dependencies and Build

Audit npm packages for known vulnerabilities (npm audit)critical

Lock dependency versions to prevent supply chain attackscritical

Use integrity hashes for CDN resourcesimportant

Review dependency code for wallet or key handlingimportant

Implement Content Security Policy headerscritical

Avoid using eval() or innerHTML with user datacritical

Minify and obfuscate production buildsnice-to-have

Testing

Test with real wallets on testnets, not just mockscritical

Test mobile wallet browser behaviorcritical

Test with slow network conditionsimportant

Test transaction failures and revertscritical

Test wallet disconnection mid-transactionimportant

Test with multiple browser extensions installednice-to-have

Implement E2E tests with wallet automation (Synpress)important

More for web3 frontend developer

Dapp Launch Checklist for Frontend Developers 55 Portfolio Project Ideas for Web3 Frontend Developers 30 Common Mistakes Web3 Frontend Developers Make (And How to Avoid Them)45 Essential Tools for Web3 Frontend Developers

← Back to resources