Skip to the cases

FREE INTERMEDIATE CASEBOOK · WORKS OFFLINE

A Blink is a doorway. Inspect what it asks you to sign.

Trace public Action API data, caller input, the transaction proposal, wallet approval, and finalized result as separate pieces of evidence.

FORMATIVE · UNSCORED · NOT SAVED

Audit six Action flows

Choose the response that respects the user’s choice and matches the evidence available.

01

POST BODY · CALLER-CONTROLLED

The endpoint receives `account: <public key>`.

Available evidence: JSON body contains a base58 account address
No proof received: No wallet signature or verified challenge

What may the server conclude?Only that the caller supplied this address; verify authorization separately and let the wallet approve the exact transaction.The account owner authenticated because only that person knows the public key.The address signed the request and accepted the transaction fee.

Choose an answer before checking.

02

UNSIGNED RESPONSE · NO EXISTING SIGNATURES

An Action returns an unsigned transaction with a stale blockhash and service-selected payer.

Requested account: Learner’s selected wallet
Transaction response: No signatures are present

What should the client do?Set the requested account as fee payer, fetch a fresh blockhash, then decode and inspect the rebuilt message before wallet approval.Accept the service’s payer and blockhash because the JSON schema is valid.Ask the learner to sign first, then replace the blockhash to reduce fees.

Choose an answer before checking.

03

PARTIALLY SIGNED · MESSAGE BOUND

A service has signed an Action transaction; the client notices an old blockhash.

Existing signature: Valid only for the exact serialized message
Client concern: Freshness may need to be re-established

What is the safe response?Replace the blockhash and retain the service signature.Verify existing signatures, preserve payer and blockhash, and reject if stale; request a newly built transaction.Ask every connected wallet to fill any required signer slot.

Choose an answer before checking.

04

CORS · PUBLIC ENDPOINT

The endpoint returns `Access-Control-Allow-Origin: *`.

Browser behavior: Cross-origin request may be permitted by the response policy
Endpoint audience: Any internet client can still make requests

What else must the service do?Trust the public-key field because a Blink passed browser CORS.Validate all input, authenticate any required business action, and rate-limit the public endpoint separately.Assume non-browser clients cannot send POST requests.

Choose an answer before checking.

05

TRANSACTION COSTS · DESIGNATED PAYER

An Action is free to use; the transaction fee payer is the learner’s wallet.

API price: No charge to request the Action
Transaction: Creates an account and transfers a token

What should the preview explain?Call the whole operation free because the API has no price.Say the token recipient always pays the network fee.Show the learner wallet as fee payer, itemize network fee and account funding, and identify the token transfer separately.

Choose an answer before checking.

06

TIMEOUT · OUTCOME UNKNOWN

The wallet signed and the client submitted, then the RPC response timed out.

Known: Exact transaction signature and intended cluster
Unknown: Whether the transaction executed and finalized

What is the next safe action?Issue a fresh Action transaction and fulfill twice if both eventually land.Mark the operation complete because POST previously returned HTTP 200.Reconcile the exact signature and resulting state on the intended cluster; fulfill at most once and offer a retry only after resolution.

Choose an answer before checking.