DApp Security
OnChainTrust provides domain verification, smart contract whitelists, and emergency controls that protect users at the wallet and browser level — before a malicious transaction is signed.
Frontend hacks, DNS hijacks, and phishing domains are increasing. When a DApp’s interface is compromised, users sign transactions to malicious contracts without knowing. By the time the team reacts, funds are gone.
Stolen in the Bybit hack — caused by a compromised signing interface that showed a fake transaction (FBI, Feb 2025)
DeFi protocols exposed by a single DNS registrar compromise (Blockaid, Jul 2024)
Drained from 332,000 wallets via phishing and malicious frontends in 2024 (Scam Sniffer)
Attackers compromise a DApp’s website and redirect transactions to malicious contracts. Users see the familiar interface but interact with the wrong addresses.
Domain DNS records get changed to point to a phishing clone. The URL looks right, the SSL certificate is valid, but the site is fake.
Users interact with smart contracts they can’t verify. One wrong approval and an entire wallet can be drained.
DApp owners register and verify their domain with OnChainTrust. We confirm domain ownership and link it to a verified entity identity. Users and wallets can check whether a domain is legitimate before any transaction.
Verified domains are stored on-chain and queryable by any wallet or browser extension.
DApp owners declare the specific smart contract addresses that users should interact with from their domain. Any transaction to an address not on the whitelist is flagged or blocked at the wallet or browser extension level.
Example: Uniswap registers uniswap.org → only Uniswap router and pool contracts are whitelisted. A compromised frontend trying to route funds to an attacker’s contract is blocked.
When a DApp owner detects a compromise — a frontend hack, a DNS hijack, a reported vulnerability — they activate the Kill Switch. It immediately discourages all user interaction with the domain until the issue is resolved.
Kill Switch is controlled exclusively by the verified domain owner. Activation is instant. Wallets and extensions with OnChainTrust integration block transactions to the affected domain.
Wallets with OnChainTrust integration display verified information about the address you’re about to interact with — before you sign.
See the verified legal entity behind the address — company name, LEI number, jurisdiction, and organizational role — sourced from the entity’s vLEI credential.
Acme Finance AG · LEI: 529900EXAMPLE000042 · Frankfurt, DE
Transaction volume, total value transferred, and number of unique addresses that have interacted with this contract — so you can gauge trust at a glance.
12,847 txns · 1,204 unique wallets · $48.2M volume
Confirms whether this address is explicitly declared as an authorized contract for the domain you’re interacting from. If it’s not on the whitelist, you’ll see a warning before signing.
✓ Address whitelisted for app.acmefinance.com
Shows which legal entity has verified ownership of the domain you’re browsing — linking the website you see to a real, accountable organization.
acmefinance.com → Acme Finance AG · verified via vLEI
Register your domain and verify ownership on OnChainTrust. Declare the smart contract addresses your users should interact with.
Users install the OnChainTrust browser extension or use a wallet with OnChainTrust integration. No setup needed — protection is automatic.
Every time a user initiates a transaction from a verified domain, OnChainTrust checks the target address against the whitelist. Unrecognized addresses are flagged.
If something goes wrong, the DApp owner activates the Kill Switch. All users are immediately warned. Transactions are blocked until the all-clear.
Register your domain, verify ownership, declare your contract addresses. Your users are protected immediately if they use the OnChainTrust extension or a compatible wallet.
Register Your DAppFree during beta. Enterprise plans coming soon.
We’re integrating GLEIF’s verifiable Legal Entity Identifier (vLEI) into domain verification. Soon, DApp owners will be verified not just by domain ownership, but by cryptographic institutional identity. This means users will know exactly which legal entity operates the DApp they’re using — verified by the same standard used in global finance.
Learn about our institutional compliance layer →Register your DApp on OnChainTrust and give your users a second line of defense.