A signature costs no gas, shows no amount, and can hand your entire balance to a stranger. Paste the request your wallet is asking you to sign and this tells you in plain English what it grants, to whom, how much, and for how long.
People have learned to be careful with transactions. A transaction shows an amount, asks for gas, and looks like it is doing something, so it gets read. A signature request looks like nothing at all. There is no cost, no obvious effect, and often a friendly sentence about verifying ownership or logging in. So it gets approved.
That difference in how the two feel is the whole reason signatures are worth attacking. The permission a signature grants is every bit as real as one granted by transaction. It simply does not look like it at the moment you give it.
Spending your tokens. A permit is an approval. Signed, it lets the named spender move up to the named amount of the named token from your wallet, until the deadline. If the amount is unlimited and the deadline is years away, you have signed something with no natural end.
Selling your NFTs. A marketplace order is a signature. It says you will give these items in exchange for that payment. An order that offers a valuable item for nothing is a complete, valid instruction, and it will be executed the moment somebody takes it.
Nothing at all. Plenty of signatures are genuinely harmless. Proving you control an address to log in is a normal use, costs nothing, and grants nothing. The point is not to be afraid of signing. The point is to be able to tell the two apart.
Three things decide whether a request is reasonable. Who is being granted the permission, and is that a contract belonging to the site you are actually on. How much, and is that number anywhere near the size of what you are trying to do. For how long, because a permission with a deadline expires by itself and one without a real deadline does not.
When those three read sensibly, the request matches the action. When the amount is unlimited, the deadline is a decade out, or the spender is an address you have never seen on a site you arrived at from a message, the request is not describing the thing you thought you were doing.
Worth being precise about, because it changes what you should do. Signing does not move anything. It creates a permission that sits in somebody else’s hands until they choose to use it, and they may wait days. That delay is the only advantage you get, and it is only an advantage if you use it. Moving your funds to a fresh address beats the permission, because the permission was written against the old one.
Because free refers to the gas, not the consequences. A signature is a written permission that anybody can later carry to the chain and use. The person who uses it pays the gas, which is exactly why they are happy to let you sign for nothing. The permission is the valuable part and you are the one giving it away.
It is an approval given by signature instead of by transaction. Ordinarily you send a transaction to a token to approve a spender, which costs gas and is visible on the chain immediately. A permit does the same thing with a signed message, so nothing appears on chain until somebody uses it. That is convenient, and it is also why it is the drainer’s preferred tool.
A very long number, usually ending in a long run of digits, or a value written as 2 to the power of 256 minus 1. In practice you will see a number with 78 digits. No honest interface needs that to sell you one token, and this tool flags it whenever it appears.
A single contract that holds approvals on behalf of many applications, so you approve it once and then sign cheap permissions for individual trades. It is a genuine improvement and it is widely used. It also means a Permit2 signature can carry an amount and an expiry that are worth reading, because the same mechanism works just as well for somebody who is not a trading application.
A signature alone does not move anything until it is used, so speed matters. Move your funds to a different address you control, because that is the only action that beats a permission you cannot cancel. Then revoke approvals from the old address. Do not wait to see whether anything happens.
No. All of the parsing happens in your browser and nothing is transmitted. You can turn off your internet connection and this page will still work.
That is eth_sign, the oldest and most dangerous signing method, and a legitimate site has almost no reason to ask for it. A raw hash is unreadable by design, which means you cannot know what you are agreeing to. Refuse it.
We seal the list every week and keep re-checking every token on it, so you can see what actually happened to them rather than only what is trading today.
