Audit an Ethereum add-chain request before accepting its RPC endpoint

Audit an Ethereum add-chain request before accepting its RPC endpoint

A web page can ask a wallet to add a network with convenient metadata. That request can also introduce an untrusted RPC endpoint that sees the user's address queries and may return misleading chain information.

EIP-3085 defines wallet_addEthereumChain parameters and security considerations. Wallets decide how they validate, store and display the requested network.

Decode the chain ID

Convert the requested hexadecimal identifier and compare it with an authoritative network source. A familiar chain name can be paired with an unexpected numeric identifier.

Reject duplicate or conflicting identifiers rather than guessing which entry is correct. The specification supports validating chain ID syntax, checking endpoint consistency and warning that RPC services can create correctness and privacy risks.

Read the full HTTPS host, provider identity and privacy terms for each endpoint in the request. RPC operators may observe IP addresses and queried wallet activity. Prefer endpoints already trusted by the wallet or verified independently.

Inspect every RPC URL

Read the full HTTPS host, provider identity and privacy terms for each endpoint in the request. RPC operators may observe IP addresses and queried wallet activity.

Prefer endpoints already trusted by the wallet or verified independently. It cannot endorse a submitted endpoint, guarantee wallet validation, authenticate a token, prove receiver support or make a custom chain suitable for funds.

Verify that the endpoint reports the same chain ID and responds consistently through more than one source. The submitted RPC value should not override the identifier the user intended. Do not send private keys or seed phrases to test connectivity.

Cross-check endpoint behavior

Verify that the endpoint reports the same chain ID and responds consistently through more than one source. The submitted RPC value should not override the identifier the user intended.

Do not send private keys or seed phrases to test connectivity. Add a network only when its chain ID and endpoints are independently documented and necessary for an intentional, understood action.

Check the currency name, symbol and explorer URL without using them as proof of asset legitimacy. A crafted symbol or explorer link can make a fraudulent chain look official. Open the explorer hostname separately before relying on it.

Treat metadata as untrusted

Check the currency name, symbol and explorer URL without using them as proof of asset legitimacy. A crafted symbol or explorer link can make a fraudulent chain look official.

Open the explorer hostname separately before relying on it. Network setup is not a harmless prerequisite when money is involved. Decline pressure from bonuses or countdowns and protect affordable limits.

Document why the network was added and remove the custom configuration when it is no longer required. Persistent endpoints continue to influence wallet queries and can create future selection mistakes. Review pending signatures before switching back to a payment network.

Remove unused networks

Document why the network was added and remove the custom configuration when it is no longer required. Persistent endpoints continue to influence wallet queries and can create future selection mistakes.

Review pending signatures before switching back to a payment network. EIP-3085 defines wallet_addEthereumChain parameters and security considerations. Wallets decide how they validate, store and display the requested network.

Convert the requested hexadecimal identifier and compare it with an authoritative network source. A familiar chain name can be paired with an unexpected numeric identifier. Reject duplicate or conflicting identifiers rather than guessing which entry is correct.

What the official source supports

EIP-3085 wallet_addEthereumChain specification: The specification supports validating chain ID syntax, checking endpoint consistency and warning that RPC services can create correctness and privacy risks.

Where the source stops

It cannot endorse a submitted endpoint, guarantee wallet validation, authenticate a token, prove receiver support or make a custom chain suitable for funds.

Make the documented decision

Add a network only when its chain ID and endpoints are independently documented and necessary for an intentional, understood action.

Network setup is not a harmless prerequisite when money is involved. Decline pressure from bonuses or countdowns and protect affordable limits.

Build the final verification sheet

A web page can ask a wallet to add a network with convenient metadata. That request can also introduce an untrusted RPC endpoint that sees the user's address queries and may return misleading chain information. Add a network only when its chain ID and endpoints are independently documented and necessary for an intentional, understood action. Network setup is not a harmless prerequisite when money is involved. Decline pressure from bonuses or countdowns and protect affordable limits.

Reject duplicate or conflicting identifiers rather than guessing which entry is correct. Prefer endpoints already trusted by the wallet or verified independently. Do not send private keys or seed phrases to test connectivity. Open the explorer hostname separately before relying on it. Review pending signatures before switching back to a payment network.

Run a final evidence review before acting

EIP-3085 defines wallet_addEthereumChain parameters and security considerations. Wallets decide how they validate, store and display the requested network. A complete review should answer each named question in order: Decode the chain ID; Inspect every RPC URL; Cross-check endpoint behavior; Treat metadata as untrusted; Remove unused networks. Keep an unanswered item visibly unresolved instead of filling it with a guess. It cannot endorse a submitted endpoint, guarantee wallet validation, authenticate a token, prove receiver support or make a custom chain suitable for funds.

Decode the chain ID requires this concrete check: Convert the requested hexadecimal identifier and compare it with an authoritative network source. Reject duplicate or conflicting identifiers rather than guessing which entry is correct. Inspect every RPC URL requires this concrete check: Read the full HTTPS host, provider identity and privacy terms for each endpoint in the request. Prefer endpoints already trusted by the wallet or verified independently. Cross-check endpoint behavior requires this concrete check: Verify that the endpoint reports the same chain ID and responds consistently through more than one source. Do not send private keys or seed phrases to test connectivity. Treat metadata as untrusted requires this concrete check: Check the currency name, symbol and explorer URL without using them as proof of asset legitimacy. Open the explorer hostname separately before relying on it. Remove unused networks requires this concrete check: Document why the network was added and remove the custom configuration when it is no longer required. Review pending signatures before switching back to a payment network.

For more context on Ethereum wallet configuration, compare the named source with the responsible-play centre, the guide library and our editorial policy. SignalBet Guide referral links are disclosed, and compensation does not control sourcing, corrections or safety conclusions.