Signature phishing and regular transfer permissions are not on the same difficulty level. With a normal transfer you can see "transfer 1 ETH to 0x...", while an EIP-712 typed signature shows a bunch of structured data containing fields like owner, spender, value, nonce, deadline, etc., looking like "login verification" or "free claim", but actually it may authorize unlimited token transfer permissions.
Step 1: Understand the essential difference in 'permission meaning' between the two signatures
【What to do】 Distinguish the authorization scope of normal transfer signatures and EIP-712 signatures.
【How to do】 See the essence from the signature content:
Normal transfer signature (
eth_sendTransaction): Signs a one-time, fixed-amount transfer operation. The signature contains the recipient address and amount. Once this transaction is executed on-chain, the permission ends. The permission boundary is clear and immediately terminated.EIP-712 typed data signature (
eth_signTypedData_v4): Signs an authorization credential that can be submitted by someone else. The signature includes fields like the token contract address, the authorized party (spender), the approved amount (value), and the validity period (deadline). The signature itself does not create an on-chain transaction, but anyone who gets the signature can submit it on-chain within the validity period to transfer tokens.
【Completion standard】 You can tell the difference between "sending money to someone" and "giving someone a voucher that can deduct money from your account at any time".
Common failure reason: Many people see a wallet signature request pop up without a "transfer amount" displayed and think it's a safe login operation. In fact, an EIP-712 signature may authorize an unlimited amount (type(uint256).max). After obtaining the signature, an attacker can drain all tokens from your wallet in multiple transfers until the authorization expires or is revoked.
High risk: EIP-712 signature phishing was the primary Web3 phishing method from 2023 to 2025, replacing traditional seed phrase phishing. The attacker only needs you to sign a message that looks like "login verification" to empty your wallet without touching your private key. The wallet itself cannot prevent you from signing a malicious signature; it can only help you decode the raw EIP-712 content on the display so you can judge for yourself.
Step 2: Verify key fields of an EIP-712 signature in the wallet popup
【What to do】 Do not blindly click "Sign"; instead, check the structured data item by item in the wallet popup.
【How to do】 When the wallet shows an EIP-712 signature request, open the details page and focus on these fields (using a Permit2 phishing signature as an example):
spender(authorized party): Confirm that this address matches the official contract address of the DApp you are interacting with. If it is an address you do not recognize, stop signing.value(authorized amount): If it showstype(uint256).maxor a very large number, it means an unlimited approval—signing it allows the other party to transfer the entire balance of that token multiple times.deadline(validity period): If this timestamp is far in the future, the signature remains valid for a long window, creating a larger risk window.token/contract(token contract): Make sure the token being authorized is the one you intend to approve, not an impersonated token.
【Completion standard】 You have confirmed that the spender in the signature request is a trusted address, the value is a reasonable amount and not an unlimited approval, and the deadline is within an acceptable range.
High risk: If the deadline field is missing or set to 0, the signature is theoretically permanent. The attacker can submit and execute the transfer at any time after capturing the signature. When deploying phishing contracts, attackers often deliberately omit or incorrectly implement expiration checks, making the signature permanently valid so they can launch an attack at any moment.
Step 3: Execute defensive operations for signature security
【What to do】 When you cannot determine the intent of a signature, do not sign it, and close risk exposure through approval management tools.
【How to do】
Do not sign EIP-712 signatures from unknown sources, especially requests framed as "free claim", "verify wallet", or "fix vulnerability".
Use an approval scanner to check your current authorization status: visit Revoke.cash, connect your wallet, and check for high or unlimited approvals given to unfamiliar
spenderaddresses.Revoke suspicious approvals: perform a revoke transaction for any risky authorization entries to cut off the attack path. Revoking requires an on-chain transaction and gas fees, but this is a necessary defensive cost.
How to verify completion: On Revoke.cash, confirm that all suspicious approvals have been revoked and no unfamiliar spender addresses remain in the list. If you have already confirmed a suspicious EIP-712 signature in your wallet (i.e., you already signed), even if no loss has occurred yet, it is recommended to immediately revoke the corresponding approval on Revoke.cash as a remedy.
