We believe part of the key to success in Web3 is to minimize your risks when it comes to protecting yourself against your own carelessness, tiredness, or… “inebriated-ness?” In Web3, it is easy to make a mistake, but difficult and usually impossible to undo them. As our contributor @KFX likes to say, "In Security, we have to get it right every time, but the scammers only need to get it right once!

Three Address Protocol for Success & Safety

You'll see some beautiful flowcharts and infographics suggesting 5 or even 7+ wallets. However, we think the risks mitigated with these models are too few to justify their cognitive expense. You're more likely to get confused and have “transaction anxiety” than feel any safer with 7 wallets! So let's keep it simple. Where should we start? I should start off by saying that all of these wallet addresses can, and probably should, be from the same hardware wallet. Need help setting up a hardware wallet? Check out this article if you are on the fence about buying one, or need help getting over that anxiety of finally moving your assets over there!

The Risk “Degen” Wallet Address

This is a wallet address you use to go to “untrusted sites”. Trying a new dApp or protocol for the first time? Use the Risk Wallet. A friend suggests you mint a new project? Use the Risk Wallet. So what is it? A wallet that you only use on untrusted sites that keeps a very low amount of money in it, and nothing valuable. Once the assets in the Risk wallet become valuable, you then send them to one of the other two wallet types (described below) for selling, trading, or safekeeping!

The idea here is that you have low-trust operations run from the wallet, with the least amount of assets at risk. You can be a little bit more reckless with a wallet that only has 0.1ETH in it than a wallet that has everything you own!

Untrusted Site: An untrusted site is merely a site that isn't a tried-and-true marketplace or one that has been around in web3 for a long time, with millions or even billions of dollars in commerce transacted on its platform.

The Trusted Buy/Sell Wallet Address

Sites that are tried and true, like Uniswap, Otherside, Opensea, Aave, or any other sites that have been around a long time that you trust, are usually where this wallet sticks to. I like to refer to this wallet as the “Bookmarks wallet,” since all the sites you visit with it should be bookmarked!

In this wallet, you should:

• Only make Approvals to trusted platforms
• Only make Signatures on trusted platforms (unless they are simply identity signatures as described here).

And you should never:

• Make any transactions on non-bookmarked and untrusted sites.

Some trusted bookmarks I have here in the image below.

The Vault Wallet Address

The Vault Wallet is a simple concept: Keep the high-value assets you don't plan to sell (but may still want to verify your ownership safely) here. Also, you should limit the transaction types that you do on this wallet. The idea is to make this wallet do only two things.

You should only:

• Do Plain-text Gasless signatures to prove identity
• Transfer/Send/Receive ETH/Tokens 

You should not:

• Make Approvals of any kind
• Sign Permit Signatures
• Do Any Smart Contract Interactions (especially on untrusted sites!)

Exception: Some folks have high-value assets that they will stake for months or years and feel better if they are in their vault wallet. In these cases, we suggest you make sure the approvals don’t stay open and use Wallet Security Extensions to increase transaction safety.

A lot of folks have anxiety over doing identity proof signatures to Discord ID bots or the like. However, with a setup like the one outlined above, you should minimize the risk of losing your assets. Additionally, some websites leverage a feature called Wallet Delegation, which allows you to attest to ownership of assets in the vault wallet address without connecting it to these sites. Learn more about Wallet Delegation here.

No article about wallets would be complete without mentioning multi-signature wallets. Although out of the scope of this article, if you have multiple people needing to use a wallet, or a team, or even doing succession planning, sharing seed phrases and the like is almost never the way. Check out our SOP for Multisig Wallets for more to keep in mind when setting up a multisig wallet!

Have any questions or want to learn more about web3 security and stay up to date on the most current security information, scams, and tactics? Join us in our discord at https://discord.gg/boringsecurity .