DeFi Safety · Fact checked

How to Prepare a DeFi Session Checklist

A repeatable pre-session routine covering browser state, wallet selection and official links.

By DeFi Tools Guide Editorial Team · Published Aug 21, 2026 · Updated 2026-08-21 · Risk level: low

This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.

DeFi Safety — illustration keyed to this article's identifier. Source documents are listed under Sources and are not reproduced here.

A DeFi session is the window between connecting a wallet and signing something. Almost every loss that looks sudden was set up earlier: a tab left open from a different site, a wallet still connected to a protocol from last month, a link opened from a search result instead of typed. A pre-session checklist exists to make those inherited conditions visible before you approve anything, while they are still cheap to fix.

The checklist below takes about two minutes. Its value is not in the list itself but in the fact that it runs before the wallet is unlocked, when you are still reading rather than approving.

Step one: close what the last session left behind

Start from a clean browser state, because a session begins with whatever the previous one left running.

Disconnect every dapp connection from your wallet’s extension before you do anything else. Most wallets expose a list of active connections; clearing it takes seconds and it removes the standing approvals that a previous session granted without you re-reading them. This matters more than it sounds: when you interact with a smart contract, do not allow unlimited spend limits, because an unlimited spend could enable the contract to drain your wallet. Approvals granted in an earlier session are still live after the tab is closed.

Uninstall browser extensions you do not use, and install new ones locally so they stop auto-updating. Extension permissions are a supply-chain risk that has nothing to do with which site you are visiting, which is why this belongs in a session routine rather than in an annual security review.

Clear the URL bar rather than trusting a hover preview. A known phishing technique spoofs a link preview to show a legitimate domain while the actual link resolves elsewhere. The defence is mechanical: read the address after the click, not before it.

Step two: pick the wallet that matches the job

Session preparation includes choosing which key signs, not just which account is connected.

For anything involving unfamiliar applications, use a wallet holding an amount you would accept losing. For a swap or a liquidity position you intend to size up, rehearse it in a wallet funded for testing. For value you are not transacting this session, it should be in storage that never touches a dapp at all — a hardware wallet keeps the private key offline so it never reaches the internet, which remains the strongest available protection if the machine is compromised.

Nobody from ethereum.org will ever contact you, and no legitimate service, support agent or website will ask for your recovery phrase. A message claiming to be official support that asks for it is the single most reliable indicator that you are in the wrong session. Staff do not move to private channels to help you, and no one needs access to your private keys.

Step three: confirm the official entry point

Before opening anything, establish where you are actually going.

Navigate to the protocol by typing the domain or using a link you already trust, not by searching for the protocol name. Sponsored results and cloned front ends occupy the top slot for common queries. Check that the domain is the one the project publishes, and check the TLS state rather than assuming the padlock means the site is legitimate — it means the connection is encrypted, not that the operator is the real one.

Have the documentation open in a second tab before you interact. You want to be reading the contract’s own limits while the confirmation screen is in front of you, not searching for them afterwards.

Step four: set the numbers before the screen appears

Gas is the unit that measures the computational effort required to execute operations, and the total fee is the gas used multiplied by the cost per unit. Every transaction is paid for whether it succeeds or fails, and a standard transfer costs 21,000 units.

A session checklist should end with a spending ceiling rather than a gas number. Set a maxFeePerGas you are willing to accept and know that unused gas is refunded. Set contract spend limits to the amount the transaction actually requires. If the interface is about to request an unlimited approval, that is a reason to close the tab, not a field to fill in.

Slippage tolerance deserves the same treatment. It is a decision made in the calm, before the confirmation screen, and it is much harder to reason about under time pressure.

Step five: leave a receipt

Record the session while the context is fresh: date, network, contract addresses touched, approvals granted, and what you intended to do. If something goes wrong later, an explorer lookup is only interpretable when you know which transaction you meant.

This is the step people skip, and it is the one that converts a bad outcome into a diagnosable one.

What the checklist does not cover

It does not make any operation safe. It does not replace reading the transaction message before signing, which is good practice whenever you interact with a smart contract. It cannot protect a wallet whose seed phrase has already been exposed, and it cannot help when a transaction to a wrong address is irreversible — unless you know the address owner and can convince them to return the funds, you cannot retrieve them.

What it does is make the inherited state of a session explicit rather than accidental, which is where the large majority of avoidable losses actually begin.