Wallet security
Provider trust, permissions, wrong-chain handling, and signatures.
#Provider trust
An injected provider can present accounts, network, and prompts. Users must verify prompts in the wallet UI.
#Network
Portfolio is gated on chain 4663. The RPC is a read dependency; a successful chain ID does not prove every later contract call succeeds.
#Signature scope
The publication message includes the serialized configuration. It does not authorize transfers.
#Privacy
A connected public address and its supported token balances are visible to the browser session and public RPC infrastructure.