Token permit messages can authorize a spender without the user seeing a familiar “approve” button. A phishing page may present a realistic claim, reward, or migration story while asking for a signature that grants value. The defense is to read the domain, chain, contract, spender, amount, deadline, and typed-data fields on a trusted wallet. A signature is an authorization event, not a harmless login.
Understand the permission surface
ERC-20 approvals set an allowance for a spender contract. Permit-style standards can package that approval in a signed message that a relayer later submits. The user may pay no gas at signing time, which makes the request feel less serious. Record token contract, spender, value, nonce, deadline, chain id, and domain separator when a wallet exposes them.
Verify the origin before connecting
Open a dapp from the project’s published documentation or a saved bookmark. Inspect the exact hostname, certificate, and redirect before connecting a wallet. Search results, sponsored links, and social replies can lead to a clone. If the page insists on a “synchronization signature” or asks for a recovery phrase, close it. A legitimate support workflow should not require secret material.
Read typed data on hardware
Use a wallet that displays typed-data fields on the signing device when possible. Check the verifying contract and chain id, not just the message title. A domain name that says “airdrop” does not describe the spender. If the device cannot show what will be authorized, reject or move to a documented, read-only inspection. Never sign a long hexadecimal payload merely because the webpage says it is free.
Set bounded approvals
When a real application needs an allowance, use the smallest amount and shortest practical deadline. Confirm the token decimals so “one” is not mistaken for one base unit or one million tokens. A bounded approval reduces blast radius but does not make a malicious spender safe. Keep a record of the transaction and the intended application so later revocation has a clear target.
Revoke and investigate
After a suspicious signature, disconnect the site, move remaining assets if necessary, and inspect approvals on the correct network through a reputable tool or explorer. Revocation changes future allowance; it cannot reverse a transfer already executed. Save transaction hashes and timestamps. If a private key or seed phrase was exposed, treat the wallet as compromised and use the official recovery plan rather than only revoking approvals.
Handle false urgency
Phishing campaigns create deadlines, countdowns, and claims that a signature prevents loss. Pause and verify through a separate official channel. The cost of missing a promotion is smaller than signing an unknown spender. A security note should state what is confirmed, what the signature allowed, and which assets or accounts were not reviewed.
Teach a repeatable review
Families and teams can use a four-question script: Which chain? Which contract? Which spender? What maximum value and deadline? If any answer is unknown, do not sign. Keep the script next to the wallet, not in the dapp’s modal. Repetition turns a confusing technical prompt into a consistent human control.
Worked example: a “free claim”
A page may show a zero gas claim while the wallet displays a permit for a large token amount, a spender contract, and a long deadline. The gas price is irrelevant if the signature authorizes later transfer. Compare the verifying contract with the project’s official documentation and inspect the chain id on the device. If the wallet cannot show typed data, close the page and use a documented approval flow. After a mistaken signature, record the message hash and revoke the allowance on the same network; do not assume disconnecting the site removed it.
Operational handoff
A useful team review separates three actions: connecting a wallet, signing a message, and sending a transaction. Each can have a different risk and record. A permit signature may be replayed by its intended contract until its nonce or deadline prevents it, so the incident timeline should include when it was signed and whether a transfer followed. Keep the message hash and chain id, then use an official explorer or wallet tool to inspect the spender.
Frequently asked question
Does disconnecting a wallet remove an approval?
No. Disconnecting changes the website session; an on-chain allowance can remain. Inspect and revoke the specific spender on the same network, then monitor for new signatures or transfers.