Learn · Security

What happens when you sign a swap

Written by XAUConnect Labs · Reviewed against live product behavior · Updated August 2026

The scary moment in DeFi is not the quote. It is the wallet modal with a hex blob. This article translates that modal into the actual state changes: what a connection permission is, what an ERC-20 approval is, what the swap transaction does, and what XAUConnect can never do even if the website were compromised tomorrow.

If you only remember one sentence: XAUConnect cannot broadcast an EVM transaction you did not sign, and it never learns your seed.

Permission to connect ≠ permission to spend

Connecting a wallet shares your public address and lets the site *request* signatures. It is closer to “this dapp may show me popups” than to “this dapp may empty the account.” You can disconnect anytime. Disconnecting does not revoke token allowances already granted on-chain.

The approval transaction (EVM tokens)

ERC-20 tokens cannot be pulled by a router unless you set an allowance. The first swap of a given token therefore often needs two signatures: approve, then swap. Native ETH/BNB/AVAX/POL do not use allowances. Unlimited approvals are convenient and dangerous. Prefer the exact amount. If you already granted unlimited, use our revoke guide and revoke.cash-style tools on the same chain.

The swap transaction

The payload names a router/spender, encoded calldata that specifies token path and minimum output, and a value field for native input. Your wallet should simulate it. On success, pool reserves update, you receive the output token, and the platform fee is skimmed per the FeeCollector configuration. On failure, EVM still charges gas. Solana simulation usually stops you before fee burn of that size, but priority fees still exist.

What a compromised website could still do

A malicious front end can ask you to sign a different payload than the UI describes. That is why you read the wallet’s decoded fields, not only our glass card. Hardware wallets help because the screen is not the phishing page. A compromised front end still cannot steal funds from people who do not sign. It also cannot invent an allowance you never granted. The defense is verification culture, not trust in a logo.

How to verify after the fact

Open the transaction on the chain explorer linked from the success state. Confirm token transfers in and out match the addresses you intended. If the output is a lookalike ticker, you swapped the clone. Save the hash; support conversations without a hash are not support conversations.

Hardware wallets change the threat model

A Ledger or similar device displays destination, chain, and amount on a screen that the phishing page cannot rewrite. That does not decode every nested AMM hop, but it stops the most common drain: signing a transfer-from-max to an attacker spender while the website still shows a swap card. If the device says “Approve unlimited” and you meant a $50 test, reject. Convenience is how unlimited allowances happen.

Legal

Risk disclosure

XAUConnect is a non-custodial swap aggregator. Digital assets are volatile and may lose value rapidly. Content on this page is educational and not investment advice. Verify every contract address on the official block explorer before approving a transaction.

Frequently asked questions

Can XAUConnect see my seed phrase?

No. Seeds live in the wallet. We never ask for them. Anyone who does is not us.

Why two popups?

Approve (once per token/spender) then swap. Native coin swaps skip approve. Solana has no ERC-20-style two-step allowance.

Does disconnecting revoke approvals?

No. Approvals are on-chain until you revoke them.

What if I signed the wrong chain?

The tx lands where you signed. Funds do not hop back automatically. That is a recovery/bridge problem, not an undo button.

Live execution

Trade on XAUConnect

Open the swap page to compare live routes, set slippage, and sign from your own wallet — fully non-custodial.

Open swapExplore markets

Continue exploring

Related markets, guides & networks

Curated next steps based on this topic — deepen your research before you trade.

Guides
Articles
Platform

Build programmatically

Swap via API for bots and AI agents — quotes, builds, and cross-chain routes.

Developer quickstart