Skip to the casebook

FREE BASIC CASEBOOK · WORKS OFFLINE

Pause before the wallet prompt.

Six fictional cases. Decide what a connection, message signature, or transaction request actually asks your wallet to do. Nothing here connects a wallet, asks for a secret, submits a transaction, or stores your answers.

Keep real SOL out of this exercise. Each case is a learning simulation. Signing is optional in the course, and you can finish every lesson, exam, and web certificate without connecting a wallet.

READ THE REQUEST, NOT THE BUTTON LABEL

Five separate actions

01ConnectMay share a public address
02Sign a messageApproves specific message bytes
03Sign a transactionApproves a transaction message
04SubmitSends the signed transaction
05VerifyCheck the intended cluster and state

A wallet’s operation name tells you which capability is being requested; the page’s friendly label does not define the authorization. If the prompt does not let you understand the domain, network, fee payer, destination, programs, instructions, or expected effect, stop and investigate.

FORMATIVE · UNSCORED · NOT SAVED

Work through the cases

Choose an answer, check it, and read why. You can retry each case.

01

CONNECT · NO SIGNATURE REQUESTED

A lesson page asks to connect a wallet to display its public address.

Wallet action: Connect
Message or transaction: None requested
Visible effect: The page can receive the selected public address

What does this connection establish? The page may learn the public address, but connection alone does not prove a signed login or approve a transaction. The wallet has verified the learner’s legal identity and confirms the site is safe. The page can now make future transactions because the wallet session approved them.

Choose an option before checking your reasoning.

02

SIGN-IN · DOMAIN MISMATCH

The page is `learn.stonkbuilder.com`, but the challenge names `learn-stonkbuilder.example`.

Wallet capability: solana:signIn
Challenge fields: Wallet address, Devnet chain, one-time nonce, expiry
Mismatch: The signed domain does not match the page origin

What is the safest response? Reject the request. The page should generate a new, server-checked challenge for the expected domain. Accept it because the nonce and expiry look correct, even though the domain differs. Ask for a transaction signature instead; any wallet signature proves the same sign-in.

Choose an option before checking your reasoning.

03

OPTIONAL PASSPORT MINT · LEARNER PAYS

A learner chooses to mint a fictional Devnet credential.

Network: Devnet, matching the learner’s choice
Fee payer: The learner’s connected wallet
Cost preview: Network fee and account-storage amount match the wallet quote
Transaction: Expected asset destination and understood instructions

What should the learner understand before approving? Minting is optional; if they approve, their fee-payer wallet funds the listed network and storage costs, and the resulting asset still needs Devnet verification. The page calls the badge free, so the wallet preview and fee payer do not need another check. A successful signature guarantees the asset is finalized and its metadata has been verified.

Choose an option before checking your reasoning.

04

TRANSACTION · UNRELATED MOVEMENT

The page says “free test badge,” but the wallet shows Mainnet and a token transfer to an unfamiliar address.

Page claim: Optional test credential on Devnet
Wallet preview: Mainnet token transfer to an unfamiliar destination
Decision: Two unexplained differences

What is the correct next action? Approve a smaller token amount because the page describes the action as a test badge. Hide the preview and approve; the website’s label is the authoritative transaction description. Reject the request. The network and token movement do not match the chosen action.

Choose an option before checking your reasoning.

05

APPROVED · PAGE TIMED OUT

The wallet returned a transaction signature, then the lesson page stopped responding.

Wallet result: A transaction signature is available
Cluster: Devnet
Application page: Timeout; it cannot report what happened

What should happen before any retry? Immediately reopen the signing prompt; the page timeout means the first transaction was cancelled. Keep the signature and cluster, check transaction status and resulting state on Devnet, then follow the documented recovery path. Search the same signature on Mainnet; the transaction can appear on any Solana cluster.

Choose an option before checking your reasoning.

06

SECRET REQUEST · ALWAYS STOP

A message from “support” asks for the recovery phrase to keep an exam certificate safe.

Requested data: Wallet recovery phrase
Claimed reason: Protect a course result
Actual need: No learning action requires this secret

What should the learner do? Stop and refuse. Use only the wallet’s independently located official recovery guidance; never share the phrase. Send it in an encrypted support message because the request mentions a certificate. Share one word at a time so support cannot reconstruct the complete phrase.

Choose an option before checking your reasoning.