Guides · Safety ·

TON Connect: what to check before connecting a dApp

Before you approve a TON Connect request in Gram Wallet, read four lines on the sheet: the app name and URL, the network, the manifest host, and whether the manifest was verified or is flagged as served from another host. Connecting shares your address and public key, plus a signed proof if the app asked for one. It does not move funds.

Every transfer the app later requests arrives as a separate request that names the amount, each destination and an emulated outcome, and needs your approval with the wallet unlocked. Requests for another network or another sender never reach the sheet.

You can disconnect at any time from the Connected apps list.

Open Gram Wallet

What this covers

  • Covers TON Connect 2 sessions opened by pasting a tc:// or universal link into Gram Wallet, or by a dApp pointing its link at Tongram.
  • Covers connect, sendTransaction and signData requests. Other methods are answered as unsupported.
  • Does not judge whether a particular dApp is trustworthy. Tongram shows what the request contains; the decision is yours.

Steps in Tongram

  1. In the dApp, choose Gram Wallet or copy its TON Connect link. In Tongram, open Wallet, then Connected apps, then Add, and paste the link.
  2. Read the app name and URL. They come from the manifest the dApp publishes, so a name alone proves nothing; the URL is what to compare with the site in your address bar.
  3. Check the Manifest line. Verified means Tongram fetched and parsed it. Unreadable means it could not, and the sheet falls back to showing the host only. Served from another host means the manifest URL and the URL inside it disagree.
  4. Check Shares: address, public key, and signed proof if requested. The proof is bound to the dApp domain, so it cannot be replayed to another site.
  5. Check Network. It must be the network you expect; a wallet on mainnet will only connect as mainnet.
  6. Approve or Reject. Approval opens a session and sends the items above through the bridge relay. Nothing is signed for transfer at this point.
  7. When the dApp later asks for a transaction, a new sheet shows the total in GRAM, the requesting host, every destination with its amount and decoded payload, and the emulated result. Approve only if it matches what you meant to do.
  8. To end a session, open Connected apps and press Disconnect next to the app. The entry disappears locally even if the relay cannot be reached.

What you see and where it comes from

  • Fact: name, URL and icon on the sheet are read from the dApp manifest, a JSON file the dApp hosts. Tongram reports the host it was fetched from and whether that host matches the URL the manifest claims.
  • Fact: messages between the dApp and the wallet travel encrypted through a bridge relay (bridge.tonapi.io unless the link names another). The relay sees ciphertext and client IDs, not your key.
  • Fact: transaction previews are emulated against current chain state through the same public TON API the explorer uses, so the outcome shown is a simulation, not a promise.
  • Fact: sessions and a local log of every dApp transaction, approved, declined or failed, are stored in this browser only.
  • Interpretation: a Verified manifest means the file was readable and consistent, not that the app is honest. Read the URL and the transaction contents on their own merits.

Freshness and limits

  • Many dApps serve their manifest without CORS headers. Then the sheet says Unreadable and shows the host; this is common and not by itself a warning sign.
  • A request that names a different network or a different sender address than this wallet is refused automatically with an error to the dApp. The same goes for an expired request or a re-delivered duplicate.
  • The emulation can fail or be unavailable when the API is rate-limited; the sheet then shows an error instead of an outcome, and the amounts still come from the dApp request.
  • Unknown: what the dApp does with your address and public key after connecting. Both are public on-chain data, but a session ties them to your visit.
  • An approved transaction is broadcast and cannot be recalled. A dApp that misdescribes what it sends is outside Tongram control; the emulated outcome is the check to lean on.

Common mistakes

  • Approving because the icon and name look familiar. Compare the URL and the manifest host with the site you are on.
  • Treating a connection as a payment. Connecting sends no funds; if a site claims a connection charged you, look at your history and the local dApp log.
  • Approving a transaction sheet without reading each destination. Several messages can be bundled in one request.
  • Leaving sessions open on a shared computer. Disconnect, then lock the wallet.
  • Pasting your 24 words into a dApp that asks for them. TON Connect never needs the phrase, and no support channel does either.

Sources

Related