The learning path
A dApp, short for decentralized application, is an ordinary website whose back end is a smart contract on a public blockchain rather than a company server. Connecting a wallet only shares your public address, it does not give the site spending power. Every action that moves value needs a separate signature you have to approve, and reading what that signature actually says is the entire skill.
What makes an app a dApp
Open a banking site and the balance you see comes out of a database that the bank owns. They can change it, freeze it, or lose it. The website and the ledger are the same organization.
Open a decentralized exchange and the page is still a normal website, usually hosted in a normal place. What is different is the back end. The balances, the rules and the money live in a smart contract on a public chain that the front end does not own and cannot edit. Anyone could build a different front end for the same contract, and several usually have.
| Normal web app | dApp | |
|---|---|---|
| Where your balance lives | The company database | A public smart contract |
| Who can change it | The company, at will | Only the contract rules, executed by the network |
| How you sign in | Email and password they store | A signature from a key only you hold |
| If the website disappears | Your account goes with it | The contract keeps running, another front end can reach it |
| Who can stop you | Support, compliance, or a bug | Nobody, which cuts both ways |
The kinds you will actually meet
Exchanges and swaps
Trade one token for another against a pool of liquidity rather than an order book run by a company.
Decentralized exchangesLending and borrowing
Deposit an asset to earn yield, or post collateral and borrow against it, with rates set by supply and demand.
DeFi explainedStaking and liquid staking
Put an asset to work securing a network, and in many cases receive a token representing the staked position.
Marketplaces
Buy, sell and list tokens and collectibles, with the settlement handled by contract rather than escrow.
NFTs explainedNames and identity
Register a readable name that points at your address, owned by you rather than rented from a registrar.
Name servicesGames and social
Applications where items, posts or accounts are onchain records rather than rows in a company database.
What actually happens when you connect a wallet
This is the step that makes people nervous, and mostly for the wrong reason. Connecting is not a payment and it is not a permission to spend. It is closer to telling a shop your name.
You click connect and choose a wallet
The site asks your browser or app which wallet you want to use. Nothing has been sent anywhere yet.
Your wallet asks you to approve the connection
Approving shares one thing: your public address. From that the site can read your balances and your history, because those are public anyway. It gets no ability to move anything.
The site may ask you to sign a message
A plain text signature proves you control the address, which is how dApps do the equivalent of logging in. A message signature costs no gas and moves no funds. Read it anyway, because a signature that mentions permissions, allowances or orders is not a login.
Every real action needs its own signature
Swapping, depositing, minting or approving each pops a separate transaction that you have to confirm. This is the moment that matters, and it is the moment people rush.
Disconnecting is cosmetic
Removing a site from your wallet’s connected list does not revoke anything you already approved. Approvals are onchain and have to be revoked onchain.
Approvals, the part that costs people money
To let a contract move a token on your behalf, you grant it an allowance. Many interfaces default to an unlimited allowance so that you never have to approve that token again, which is convenient right up until the contract you approved turns out to be malicious or gets exploited later.
The allowance sits there until you revoke it. Wallets drained months after the fact are almost always an old approval being called, not a new break in.
Approve amounts, not infinity
Where the interface lets you set a specific figure, set one. The extra gas on future transactions is small insurance.
Review approvals periodically
Revoke anything you no longer use. Your chain’s block explorer has a token approval tool, and so do the major wallets.
Use a separate wallet for anything new
Fund it with gas and the one token you need. A bad approval there costs you nothing that matters.
The full version of this, with the revocation walkthrough, is on the token approvals page.
Using a dApp without getting hurt
Reach it from a bookmark
Never from a search result. Paid adverts sitting above the real listing are the single most common way people land on a cloned front end.
Read the signature, not the button
Your wallet shows what you are about to authorize. If it says setApprovalForAll or grants an allowance you did not ask for, reject it.
Check the contract, not the design
A pixel perfect clone is a weekend of work. The contract address on the project’s own docs is the thing that is hard to fake.
Small first, always
Run the smallest possible amount through a new app end to end before you trust it with a real position.
Hardware wallet for real size
It puts a second screen between a hostile site and your keys, and a website cannot fake that screen.
Hardware walletsNobody legitimate needs your phrase
No dApp, ever, for any reason. A site asking to validate, sync or restore your wallet is a theft in progress.
Why it asks for gas twice
New users often expect one confirmation and get two. Approving a token and then swapping it are separate transactions, so each one costs gas. On Ethereum mainnet that is annoying and occasionally expensive. On a layer 2 or on Solana the second fee is small enough that most people stop noticing it. That is a real reason beginners are usually better off learning on a cheap network.
Common questions
Is connecting my wallet to a dApp safe?
Connecting by itself shares only your public address, which is already public. The risk is in what you sign afterward. Treat the connection as harmless and every signature as the real decision.
Can a dApp take my funds without me approving anything?
No. Moving your assets requires a signature from your key, and your key never leaves your wallet. What a hostile site can do is present a signature that does far more than it appears to, which is why reading the wallet prompt matters more than trusting the page.
What does disconnect actually do?
It removes the site from your wallet’s connected list so the page stops seeing your address. It does not revoke token approvals, which live onchain and have to be revoked with a transaction.
Do I need a different wallet for each dApp?
No, one wallet works everywhere on a given chain. Many people do keep a separate wallet for experimenting, so that a bad approval cannot reach their main holdings.
What is the difference between a dApp and a website?
The front end is usually a normal website. What makes it a dApp is that the state it operates on lives in a public smart contract instead of a private database, so the operator cannot edit your balance and cannot lock you out.
Where to go next
Stuck on this one?
Some things click faster with someone walking you through them live. Orca sessions are one to one, screen shared, and paced for wherever you actually are.