Domain review request — fbtswap.ir (FBT Swap), non-custodial swap front-end

[mshiravi433-ctrl]

dApp Name

fbtswap

dApp URL

Fbtswap.ir

Program ID

ir.fbswap.app

Steps to reproduce

Domain: https://fbtswap.ir
Project: FBT Swap — a non-custodial swap and DeFi front-end on 10 networks (EVM + Solana).
Public source code: https://github.com/mshiravi433-ctrl/fbtcryp

The problem
Phantom shows the full "This dApp could be malicious. Do not proceed unless you are
certain this is safe" screen when our users connect or sign from https://fbtswap.ir.
We would like the domain reviewed and, if it is a false positive, cleared.

What the dApp asks the wallet to do

• Solana: Jupiter and OpenOcean routes only. Every transaction is signed AND
  broadcast by the wallet's own signAndSendTransaction; our page never broadcasts
  a wallet-signed transaction (src/lib/launch/solana/signing.js → signSendConfirm).
• EVM: standard ERC-20 approvals, always minimum amount, never unlimited
  (src/lib/intent-ai/approvalHygiene.js), swaps and deposits/withdrawals on
  third-party audited protocols (Aave, Lido, Compound, Morpho, bridges).
• We hold no funds, never request eth_sign, never ask for a seed phrase or private
  key, and never request delegate or owner authority.

Verification completed

• WalletConnect/Reown domain verification live at
  https://fbtswap.ir/.well-known/walletconnect.txt
• Sample mainnet transactions through the site: <TX_HASH_1>, <TX_HASH_2>, <TX_HASH_3>
• Identity: X https://x.com/CompanyFbt · Crunchbase
  https://www.crunchbase.com/organization/fbt-company · contact fbtswap@gmail.com
• Legal pages: https://fbtswap.ir/legal/terms · /legal/privacy · /legal/disclaimer

Could you share the actual criteria for clearing a new, legitimate domain? Happy to
provide a walkthrough video, calldata, or a simulation for any specific
transaction.