previous: Log All Signature Requests | Contents | next: Compare Old Transactions
Signature Managers MUST maintain an allowlist of permitted signing addresses and MUST reject signing requests for addresses not on the list.
Ensure that transactions are not signed by an unauthorized party, and that adding an authorized signer provides sufficient friction to incentivize careful usage without imposing warning fatigue that leads to insecure workarounds becoming a habit.
Verify that the Signature Manager has an allowlist of parties who can sign transactions.
Present a transaction for signature by a party who is not on the allow list, and verify that the Signature Manager requires a separate step to add the User to the allowlist.
The Signature Manager requires signatures to be made by parties on an allow list, and requires a separate step outside the main signature workflow to add a party to that list
previous: Log All Signature Requests | Contents | next: Compare Old Transactions