OSLANDS
Security

How we protect your assets

OSLands is built with the safety of land and NFT owners as the top priority.

How sign-in works

Sign-in uses only a message signature (Sign-In with Ethereum). It lets us confirm that you own the wallet and show your lands and guilds.

The sign-in message names this website, so a signature made here cannot be reused on another site. Your wallet may also show a warning if a different site ever asks you to sign in for this one.

What we never do

  • We never ask for permission to transfer your NFTs.
  • We never ask for token approvals.
  • We never initiate transactions on your behalf.

Even if this website were compromised, attackers could not move your assets, because the site technically has no such permissions.

Every important action is confirmed by a new signature

Creating or joining a guild, founding an alliance, choosing your primary guild or linking a social account each ask for a fresh signature of a short, readable text like this one:

Join guild "Koda Hunters" on OSLands
Wallet: 0x5290…9EE7
Timestamp: 2026-09-27T12:00:00.000Z
Nonce: a1B2c3D4e5F6g7H8i9J0

The text is shown in our own dialog first, then in your wallet. Each signature can be used only once, for that exact action, within five minutes.

Technical guarantees

The site talks to your wallet through a strict allow-list. These are the only wallet requests it can make:

  • eth_requestAccounts
  • eth_accounts
  • eth_chainId
  • personal_sign
  • wallet_requestPermissions
  • wallet_getPermissions
  • wallet_revokePermissions

Requests like these are blocked before they can ever reach your wallet:

  • eth_sendTransaction
  • eth_signTransaction
  • eth_sendRawTransaction
  • eth_sign
  • eth_signTypedData
  • eth_signTypedData_v3
  • eth_signTypedData_v4
  • wallet_sendCalls
  • wallet_addEthereumChain
  • wallet_switchEthereumChain
  • wallet_watchAsset

Sessions use short-lived tokens in secure, HTTP-only cookies. You can sign out on all devices or delete your account and unlink your wallet at any time from your profile.

Market, watchlist and alerts

Prices, listings and sales are read from OpenSea by our server. The "Buy on OpenSea" button is a plain link: the purchase always happens on OpenSea, and this site has no code that could create an order or an approval.

Watching plots and saving price alerts are private settings of your account. They use your signed-in session only, so they never open your wallet at all.

Analytics

We use Google Analytics to see which pages and features people use. Until you accept cookies it runs in a cookieless mode that only counts anonymous visits; advertising features are always off. Your wallet address is never sent to it. You can change your choice any time with "Cookies" at the bottom of the page.

Additional recommendations

For maximum safety, read every message your wallet asks you to sign, and use a hardware wallet when working with valuable assets.

Security · OSLands