Payloads

Every sign path (Wallet send, Swap, Bridge, Cafe, suite action=sign|pay) must show network, amount, destination, and irreversible copy before the user signs.

Native units only

Never do amountFloat * 1e6 (or * 1e18) in IEEE float. Convert with integer math or a decimal library that emits a string/bigint of whole units.

# BAD — float rounding
(0.1 * 1e6).toString()

# GOOD — integer drops / lamports / wei
drops = 100000n

Pass those integers on Wallet pay/sign deep links as decimal strings, not JSON floats.

Warning modal (required)

Before sign:

1. Chain / network label
2. Amount in native units and a display string
3. Destination (truncated + copy) or offer/NFT id
4. Platform fee bps when the product takes a cut
5. Irreversible warning
6. Wrong-chain / memo-required copy when relevant

Re-auth

Default idle: 1 hour (REAUTH_IDLE_MS = 3600000).

If the user has been idle ≥ 1 hour (or tapped Lock), require PIN / swipe again even if rdl_sess is still set. SSO cookie ≠ signing unlock.

Never

• Log seeds, PINs, or raw keystore dumps
• Put keys in URLs, cookies, or ads payloads
• Skip the warning modal for “small” amounts
• Mix Xaman payload UUIDs with suite rdl_sess