Why a gasless signature can be risky
Wallets sometimes show a signature request instead of a transaction. Logins and order placements cost no gas and are not recorded on chain right away, so it is easy to approve them casually. Some signatures, however, can later be used by someone else as permission to take your tokens.
This piece shows how to read the domain and message fields a wallet displays for EIP-712 typed-data signatures. It analyzes a hypothetical permit signature, which hands over token spending rights with a single signature, and lists what to check before signing.
What EIP-712 defines
EIP-712 defines hashing and signing structured data with named, typed fields instead of opaque bytes. That lets wallets show which app and which message a signature is for, and what each field's value is.
Signed data has two parts: a domain and a message. The domain can include the app's name, version, chainId, and verifyingContract, which reduce the risk of the same message being replayed in another app or on another network. The message contains what is actually being authorized.
A hypothetical permit request
ERC-2612 defines permit, which lets a token holder grant another address spending rights with a signature rather than a gas-paying approval transaction. The table reads a hypothetical permit request field by field.
| Part | Field | Value in the request | What to check |
|---|---|---|---|
| Domain | name / version | USD Coin / 2 | Whether you actually hold this token |
| Domain | chainId | 1 (Ethereum mainnet) | Whether it matches the network you are using |
| Domain | verifyingContract | 0xA0b8…eB48 | Whether it matches the official token contract |
| Message | spender | 0x9f3c…71aa | Do not sign if you do not know this address |
| Message | value | 115792… (2²⁵⁶ − 1) | Effectively unlimited approval |
| Message | deadline | Year 2099 | Expiry in the distant future |
This signature grants an unknown address unlimited spending rights over the token for decades, with no gas paid. Signing moves no tokens, but the recipient can submit it at any time and use the permission.
How a signature becomes a permission
Whoever receives a permit signature can submit it to the token contract to register the approval and immediately move tokens up to the approved amount. Because signing leaves no on-chain record, users often learn they granted permission only after their tokens are gone.
Ethereum.org's security guidance stresses not approving signature requests from sites of unclear origin. Wallets often warn about transactions, but signature requests appear on lighter-looking screens where attention easily slips.
Checking the domain and message
When a signature request appears, work through these steps.
- Confirm the requesting site is the official site you meant to use.
- Check that the domain's chainId matches your current network and the verifyingContract matches the official contract address.
- If the message has a receiving address such as spender, to, or recipient, find out whose it is.
- Check that amounts such as value or amount are only what you need and not close to unlimited.
- Check expiry fields such as deadline or expiry and the nonce; if you cannot understand the content, do not sign.
Telling legitimate uses apart
Typed-data signatures are useful. Many legitimate services use them for decentralized exchange orders, gasless approvals, and logins. A legitimate request usually matches what you just did, with amounts and expiry limited to what that action needs.
If clicking "verify wallet" or "claim airdrop" produces a signature that hands over token spending rights, the action and the content do not match. If a wallet cannot display the data in readable form and shows only a long hexadecimal string, you cannot tell what you are signing, so take extra care.
If you already signed
If you signed a suspicious permit, it may not have been submitted yet. Sending another approval that uses up the nonce on the same token contract, or moving the token to another wallet, can make the signature useless. If it was already submitted and the approval registered, a transaction setting the approval to zero revokes it.
These steps cost gas, and timing matters. Making a habit of reviewing the approvals registered to your address with a block explorer's approval tool helps you respond quickly when something goes wrong.
Keeping most holdings in a separate wallet that never connects to new sites limits the damage a single bad signature can do. The wallet you use for experiments then holds only what you are prepared to risk.
What was simplified
The addresses and values here are hypothetical and illustrate the structure. Real requests vary in field names and layout across apps, and wallets differ in how they display them and when they warn.
When signing, check EIP-712, ERC-2612, Ethereum.org's current material, and your wallet's official guidance with their dates. Any decision remains yours, based on your own circumstances and risk tolerance.