In the past few days, I've seen a few more "normal transfers with hidden malicious content" authorizations, and the smell is too strong... To put it simply, don't take photos of your seed phrase or upload it to the cloud, even if you think you're very secure, losing your phone once will teach you. Don't just click confirm when you see a pop-up for signatures; those phishing sites that say "sign here to receive airdrops" are just handing over your keys after you sign. My small habit: only grant necessary permissions, revoke them after use, and manually type the domain for unfamiliar links. By the way, about NFT royalties—people argue a lot, and it's understandable that creators want to survive and secondary markets want liquidity, but don't use "support creation" as an excuse to sign a bunch of strange authorizations... No matter how small your position is, you can't afford to play like that.