A production walkthrough of the auth pattern powering CoinHawk's admin layer — and why "the client says they're 0xABC" is a security bug. The naive way (and why it's broken) When a user connects MetaMask to your dapp, the browser hands you their wallet address through window.ethereum.request({ method: "eth_requestAccounts" }). Tempting flow: Frontend asks MetaMask for the address Frontend POSTs