app.xroot.dev flagged "could be malicious" when a signing request contains more than one transaction

[SulimanMukhtar]

Summary

Any signing request from app.xroot.dev that contains two or more transactions is blocked with "This dApp could be malicious. For your safety, Phantom has blocked this request." A single transaction from the same site and the same wallet previews normally and signs fine.

It doesn't depend on what the transactions do — two tiny SOL transfers get blocked the same way a batch of account closes does. The domain is not in phantom/blocklist, so I think this is the simulation layer rather than a listing.

app.xroot.dev is a non-custodial Solana token-operations console — rent reclaim on empty token accounts, wSOL unwrap, token deployment and authority tools. Every transaction is built unsigned and signed by the user's own wallet, which is also the fee payer. We hold no keys and no funds.

I've submitted the dApp Review form and have ticket 359878 open since 4 September.

Could someone let me know what's needed to get app.xroot.dev and xroot.dev reviewed — other than a vouch? I've been told to find an established developer in the Solana community to vouch for me, but I've built this on my own and have no one to ask.

Example

https://app.xroot.dev

Steps to Reproduce

Not reproducible on the live site any more — we changed it to send one transaction per signing request as a workaround, so users now approve each transaction separately instead of approving the batch once. Going back to a single approval is what I'm asking for.

Happy to provide anything the team needs.

Phantom Version

No response

Is there an existing discussion for this?

• I have searched the existing discussions

[Th3Ya0vi]

Thanks for reaching out. Please contact our support team at help.phantom.com, where someone from our Trust & Safety team can assist with reviewing the warning. You can also follow our Domain and transaction warnings guide for guidance and next steps.