SMART CONTRACTS, DEFI & WEB3 SECURITY - Chapter 5, Exercise 1 Solution
==========================================================
Why "Paste Your Seed Phrase to Connect" Is a Serious Red Flag

PROBLEM
-------
A user reports: "This dApp's website asked me to paste my seed phrase
directly into a text box to connect my wallet." Using this chapter's
own explanation of how MetaMask actually signs transactions, explain
why this is a serious, non-standard red flag rather than normal dApp
behavior.

SOLUTION
--------
This chapter is specific about how a normal, legitimate wallet
connection actually works: a dApp's own website JavaScript code never
has direct access to the user's private key at any point. Connecting a
wallet means the dApp requests a connection through MetaMask's own
injected interface, MetaMask (running separately, as a browser
extension, not as part of the website's own code) handles the
approval, and the dApp only ever receives the user's public address -
never any key material, and certainly never the seed phrase that could
regenerate every one of the user's keys (Course 1, Chapter 7).

A legitimate connection request should never require the user to type
or paste their seed phrase into ANY website's own text box, full stop -
there is no real, standard dApp workflow that needs this at all. The
entire design of the wallet-extension model this chapter describes
exists specifically so a website never needs, and should never be
given, that information.

A website asking for a seed phrase directly is not a technical
connection request - it's requesting the exact information needed to
regenerate every key the wallet has ever derived (Course 1, Chapter 7's
own HD-wallet mechanics), which would let whoever receives it take
complete, permanent control of every asset those keys control. This is
a well-known, extremely common phishing pattern specifically because
it works: a user who doesn't realize how wallet connections are
actually supposed to work might mistake the request for a normal login
step.

ANSWER: This is a serious red flag because a legitimate wallet
connection never requires a website to see the seed phrase at all - the
wallet extension itself handles signing separately from the website's
own code, and the dApp only ever receives the user's public address.
A site requesting the seed phrase directly is almost certainly a
phishing attempt trying to steal complete control of the user's wallet,
not a normal part of connecting to a dApp.

----
WHY THIS WORKS AS AN ANSWER

This contrasts the actual, chapter-described connection mechanism
(public address only, key never exposed) against what the reported
behavior is actually requesting (the seed phrase itself), making clear
why the mismatch itself is the red flag rather than treating the
behavior as merely unusual.