Bookmarklet · no install
LitGuard Bookmarklet
Intercepts eth_sendTransaction / eth_signTypedData_v4 / personal_sign / eth_sign before your wallet ever sees them — a LitGuard checkpoint in front of MetaMask, Rabby, or any injected wallet, scoped to LiteForge (chain 4441). No extension, no install: one click on the page you're using.
Drag this button to your bookmarks bar. It arms LitGuard on whatever page you click it from — clicking it here just arms it on this page, which is harmless but pointless; the point is to click it on a dApp.
How to use it
- Drag the “LitGuard” button below to your bookmarks bar.
- Open the dApp you're about to use, and connect your wallet as usual.
- Before clicking Approve/Swap/Confirm, click the LitGuard bookmark once.
- A checkpoint appears over the page the moment your wallet is asked to sign or send — review it, then Continue or Reject.
- After a full page reload, the bookmarklet needs to be clicked again — it doesn't persist across navigation.
What it's based on
- Same engine that powered LitGuard's earlier browser extension: a real decoded diff — token/native balance changes, unlimited-approval flags, contract name and verification status, revert reason if the call would fail — backed by the same simulation and signature-decoding engines as the
/previewand/sign-previewpages. - Reject genuinely blocks the wallet call (not just the on-page dialog) — the request never reaches your wallet. Continue forwards the untouched request, which then behaves exactly as if LitGuard weren't there.
Known limits
- Depends on the dApp page's own Content-Security-Policy: it must allow loading a script from litguard.pro, and separately allow this checker's own network request back to litguard.pro. A strict CSP that disallows both means the bookmarklet silently does nothing, or shows a dialog that can't reach the check and fails open with a "check unavailable" notice.
- Runs after the page's own scripts have already executed — unlike a browser extension, which injects before any page code runs. This defends against generic, careless drainer behavior, not an adversary who specifically targets LitGuard's own on-page checkpoint.
- Doesn't persist across a full page reload or navigation — click it again after either.
- Doesn't yet check the wallet's current chain — it simulates against LiteForge (4441) regardless of what chain your wallet is actually on.
- Only sees requests that go through an injected provider (window.ethereum / EIP-6963). WalletConnect and mobile in-app browsers aren't covered.