This article explains how to interpret Ledger Extension warning messages.

Rather than continue updating Ledger Extension as a standalone app, we’re integrating many of its features, such as Web3 check, into other parts of the Ledger ecosystem to streamline your experience and make it easier to securely manage your assets.

You can still use the Ledger Extension app if you have it already downloaded, but it will no longer be available to download and we have no plans to further update the app.

Please download the last update of Ledger Live Application:

1. Ledger Live for Windows 10/11

2. Ledger Live for MAC

3. Ledger Live for Android

Key terms:

✅ Allowlist – contains known trusted domains, URLs, smart contract addresses, and dApps. Ledger Extension allowlist relies on data fetched from Etherscan, Chainabuse and Chainalysis.

❌ Blocklist – contains untrusted domains, URLs, smart contract addresses, dApps, and other sources that are known to be suspicious or harmful. Ledger Extension blocklist relies on data fetched from Etherscan, Chainabuse and Chainalysis.

⚠️ Every warning message has two versions: blue and red. Blue means that you’re interacting with a trusted dApp. Red indicates that you’re interacting with a dApp that’s unknown, suspicious and potentially malicious.

☑️ Web3 Check 

Warning message	Meaning
	The website is on the allowlist. However, the transaction you’re signing is linked to a smart contract that’s not on the allowlist. Make sure you trust the site and carefully review transaction details.
	This may or may not be an issue. A new smart contract is probably not an issue if the dApp was recently launched. However, if the dApp was released months ago, this can be problematic—established dApps rarely change contracts.
	Heads up. It’s the first time you’re interacting with this smart contract. Carefully review transaction details.If you’ve interacted with this website before, make sure you’re using the correct URL. If you’re used to interacting with this dApp and you’re seeing this message, there’s a possibility  that the dApp has been compromised, or that it’s a new smart contract that has been deployed by the dApp.
	You’re sending assets to an Externally Owned Account (EOA), not a smart contract. EOAs are controlled by users, not smart contracts. You can be scammed into sending assets to an EOA and have them stolen.

Wallet Preview

	Ledger Extension can’t identify what will happen.
	The transaction may fail. This can be caused by an error in the smart contract that prevents it from running.
	The balance of your account is too low to cover gas fees. Deposit more ETH or wait for lower fees.
	A dApp that isn’t on the allowlist requests unlimited ERC20 token spend approval.
	A dApp that isn’t on the allowlist requests approval for spending all your NFTs.
	A dApp that isn’t on the allowlist requests approval for spending one of your NFTs.

ℹ️ Ledger Extension automatically scans smart contracts and looks for malicious code and vulnerabilities. Although its database is regularly updated, keep in mind that the extension can’t detect all malicious activities that are constantly growing in number and sophistication.