Overview

This Policy type enables you to govern your dApp connections directly from your workspace. You can allow or block specific dApps from being connected to your workspace.

With our latest update, dApp connections are restricted to a Managed dApps list. This list can include:

• Fireblocks predefined list: a curated set of frequently used dApps, defined by Fireblocks.
• Customer-defined list: dApps that you whitelist and approve within your workspace.

Benefits

The benefits of developing the dApp connection policy are:

• It adds an additional layer of protection to your assets by governing the dApp connection process.
• It prevents malicious attacks that connect existing, legitimate contracts to malicious dApps.
• It allows you to specify exactly who within your organization can connect to certain dApps based on their operational roles or areas of responsibility.

Creating a dApp Connection Rule

To get started, in the Console’s left navigation panel, select Policies > dApp connection to create a Policy rule.

When defining a rule, the Destination must be selected from the Managed dApps list. You can select from:

• Fireblocks predefined dApps: A curated set of ~100 commonly used dApps, defined by Fireblocks.
• Customer-defined dApps: dApps that your organization adds to its workspace by creating and whitelisting them (see Adding dApps to the workspace section below).

If a dApp is not in either list, the connection will be blocked until it is added to your workspace’s whitelist and approved.

Adding dApps to the Workspace

To extend beyond the Fireblocks predefined list, you can add your own dApps directly into your workspace:

1. In the Console’s left navigation panel, go to Whitelisted Addresses.
2. Select Add.
3. Select Whitelisted dApp wallet.
4. In the Add a whitelisted dApp wallet modal, enter the container name (e.g., DeFi dApps).
5. Select Add wallet.
6. Select Add dApp.
7. In the Whitelisted a dApp modal, enter the dApp details (name and URL).
8. Submit for quorum approval, the same way you approve external or internal wallets or contracts.

Once approved, these dApps appear in your workspace under the Whitelisted addresses.
When you next create or edit a dApp Connection Policy rule, you can select from:

• Fireblocks predefined dApps
• The dApps you have created and approved within your workspace

This workflow ensures that only allowed dApps, whether Fireblocks-defined or customer-defined, are available for connections.

Configuring an existing dApp Connection Rule

Use the Policy Editor to configure an existing rule. 

Enforcement Across Platforms

Once dApp connection rules are configured, Fireblocks enforces them across all dApp connection paths to ensure consistent security coverage. Enforcement now checks against the Managed dApps list:

• If the dApp is predefined or customer-defined, the rule applies as expected (Allow/Block). If the dApp is not in the Managed dApps list, the connection is automatically blocked.
• If the dApp is not predefined or customer-defined, the connection is automatically blocked.
• When attempting to add a new dApp, workspace quorum rules apply — admins may need to approve the dApp before it can be used.

If a dApp is flagged as suspicious (e.g., by Fireblocks’ security integrations), users are warned, and an admin signature/approval may be required.

Enforcement applies consistently across the following interfaces:

Console

When you attempt to connect a vault to a dApp through the Console interface, you will be blocked or allowed based on the applicable policy. If a dApp is not on the Managed dApps list (predefined or customer-defined), the connection will be rejected with a clear message and guidance to adjust the policy or add the dApp to your workspace whitelist. As an admin, you can manage, approve, and edit rules through the policy section of the Console.

Browser extension (DeFi)

When you interact with dApps via the browser extension, policy enforcement occurs before the dApp connection is finalized. If you switch vaults mid-session, the extension checks whether the new vault is permitted to connect to the dApp under the active policy.

If the new vault is not allowed to connect based on the Policy rules, and it is currently connected, you will be disconnected. If it is not connected, no action is required. These enforcement checks follow the same policy logic defined in the Console.

Mobile

The Fireblocks mobile app also enforces the connection policy. When you attempt to connect to a dApp via mobile device, you will see the same enforcement behavior as in the Console and extension. If an unauthorized connection attempt occurs, the app will guide you through steps to either request admin approval or modify existing Policy rules.

This multi-platform enforcement ensures secure and predictable behavior regardless of how you initiate a dApp connection.

To ensure secure interactions with a dApp, Fireblocks enforces dApp connection rules upon every dApp connection attempt and every transaction with a dApp, to make sure the connection is valid. 

Connection rejections and the “Connected dApps” view

Once a dApp connection rule is properly configured, you will only be able to connect to dApps that are explicitly allowed by that rule. When a connection is successfully made to an allowed dApp, it will appear in the Console’s Connected dApps section, located under the Web3 access tab, which shows all currently active or recently connected dApps.

If you try to connect to a dApp that is not included in the Managed dApps list (predefined or customer-defined, and not permitted under any rule), the system will block the connection.

In such blocking case, you will see the “This connection is not allowed by the policy” rejection message displayed:

• In the Console, when attempting a connection manually.
• In the DeFi extension, during interaction with a non-authorized dApp.
• In the mobile app, upon triggering an unauthorized dApp connection.

The message indicates that the dApp either:

• Has not been added to the Managed dApps list (predefined or customer-defined), or;
• Is not permitted by any active policy rule assigned to you or to the vault.

You will be prompted, where applicable, to take further action, such as submitting the dApp for approval or requesting a policy change from an admin.