Safety and privacy

Web apps and your wallet

The rules a web app plays by when it talks to your Hermit wallet.

Open an app from Explore and it finds a wallet called Hermit, on EVM networks and on Solana. This page is about what that app can and can’t do with it.

Nothing until you connect

A site sees no account at all until you connect it. When it asks, you get a review titled “Connect to app.uniswap.org” that lists the site, the wallet, the network, and what it shares: “This address and its balances”. It also says “Connecting can’t move funds: every signature asks you again”.

Connecting only shares your address. Every signature after that gets its own review and your Face ID (Touch ID on a Mac).

Who’s really asking

Every request is tied to the address WebKit, Safari’s engine, reports for the page itself. Never to one the page claims. On top of that:

The wallet only exists on https pages. An http page doesn’t get it.
It isn’t put into frames, so an ad or widget embedded in a page can’t use it.
A request sent while the page is leaving for another site is refused.
A site can have at most three requests waiting, and you see them one at a time.

Each review starts with that check: “Asked by app.uniswap.org, the page itself (HTTPS, not an embedded frame)”. If the site is in Explore’s directory, there’s a second line saying so.

Lookalike sites

Before you connect or sign, Hermit looks at the site’s address and warns you in amber. The first two come from comparing it with the apps in Explore’s directory.

“This looks like uniswap.org, but it’s unlswap.org. Check the address before connecting.”
“This address contains uniswap.org but belongs to claim-now.xyz. It is not uniswap.org.”
“This address uses international characters (punycode xn—…). It can imitate another site’s name letter for letter.”
“This page is a bare IP address, not a named site.”

A sign-in message written for one site but asked for by another gets: “This sign-in message is for app.uniswap.org, but the page asking is … Phishing sites do this to steal a login.”

What Hermit refuses

Some requests never reach a review:

eth_sign. It can sign a transaction blindly. Sites have to use personal_sign instead.
Older typed-data versions. Only eth_signTypedData_v4 works, and its chain has to match the network the site is on.
Deploying a contract from a web page.
A transaction for a different network than the site is on, or from an account that isn’t the connected one.
A Solana “message” that’s really a transaction: “This message is a Solana transaction. Hermit only signs transactions it can show you.”

Before you approve a transaction

Hermit runs each transaction against the chain first and puts what it found on the review.

“You send” and “You get” lines show what leaves your wallet and what comes back, from a simulation. If the simulation fails, the top warning says it will probably fail and may still cost a fee.
A call that lets another address spend your tokens says so. For an unlimited one: “Unlimited approval: 0x1111…2222 could move all of your USDC, now and later, until you revoke it. Approve an exact amount on the site if it offers one.”
If Hermit can’t decode a call, it says so and shows the simulated balance changes instead.
It checks you have enough for the network fee, and warns if you don’t.
The spending policy applies to what leaves your wallet: the daily limit and the new-address warning.

After you approve, Hermit checks the signed transaction against what you saw before it goes out. A signature that fails its self-check never goes back to the site.

Disconnecting a site

Open Settings, then the Sites tab.
Each connected site shows its wallet, the address it sees, the network and when you last used it.
Tap Disconnect next to one, or Disconnect all at the bottom.

A disconnected site sees no account until you connect it again. Removing a wallet disconnects its sites too. The list is kept on your device only.