👤 Contacts

Paying a name, not an address

Product

walllet.com

Role

Product Designer

Industry

Finance, Banking

Year

2023

Why the address field is the most dangerous input in crypto

An address is unreadable, unmemorable and uncorrectable. One wrong character sends money to a destination that exists, belongs to nobody reachable, and cannot be recalled. The industry's answer has been to ask the user to check it, compare the first four characters and the last four, or trust whatever is on the clipboard. That is a person doing a machine's job, on the one action with no undo.

It gets worse with repetition. The send our users make most often is a deposit to their own exchange account: the same destination, over and over, re-pasted every time. That is also precisely what clipboard-hijacking malware waits for. The highest-frequency send in the product was also its highest-risk one, and it was being handled by copy and paste.

The problem in one sentence: the address field asked our users to visually verify 42 characters they cannot read, every time, on the one action that cannot be undone.

TRADE-OFFS

What I gave up to make a contact mean a person

A contact book is easy to build badly. Store one entry per address and the list becomes as fragmented as the addresses it was meant to replace. Verify everything and the verification mark stops meaning anything. Both failures come from the same instinct — letting the data model choose the interface — and both were live decisions here.

WHAT I CHOSE	WHAT I CUT	WHY
One contact holds every address that belongs to it	One entry per address	People think in people and services, not keys. The cost lands on the contact record, which then has to resolve which of its addresses applies to the transaction in play.
Recognised exchange addresses saved automatically	Asking the user to save them	The destination someone uses weekly should never need manual filing. The cost is that automatic entries must read as different from ones the user typed.
The verified mark only where the service can be confirmed	A trust score on every contact	A mark that appears on everything communicates nothing, and a name the user typed must never borrow authority the product did not verify.
Own wallets inline, tagged	A separate accounts screen	Moving funds between your own wallets is the same task as paying someone. Splitting it into a second screen adds a decision before the user has done anything.

MY CONTRIBUTION

What I owned on walllet contacts

WHAT I OWNED
The contact model — one contact, many addresses — and what a contact record has to carry to be recognised at a glance. The automatic verified exchange contact and the visual line between it and a user-created one. Own wallets grouped inline with a tag rather than exiled to their own screen. The hierarchy of the address screen, where contacts are the default and scanning and pasting are the fallback. And the link between a contact's status and the receiver-address label that appears later, at checkout.

The address someone pastes most often is the one they should never have to paste.

DESIGN DETAIL

How the address screen puts people before keys

Contacts are the default state of the screen, not a feature parked behind a button. The empty field sits at the top for the send that genuinely is new, with scanning and pasting beside it, and everything below is people. A name and a face do the recognition work forty-two characters cannot, and the truncated address stays visible underneath for anyone who wants to confirm it.

Status travels with the contact. A saved contact and a verified exchange both change what the user sees at checkout, the same address that would otherwise read as unfamiliar arrives labelled, next to the amount, at the moment of confirmation rather than in a warning nobody asked for.