After seeing a wallet warning that says "signature request expired", many users worry whether requesting the signature again is safe or whether it could be intercepted by attackers. The short answer is: requesting the signature again is safe, but only if you confirm two things — that you are signing the same request, and that you have not switched to a completely unfamiliar network environment after the timeout. A signature expiring is a protocol-level timeout mechanism, not a security vulnerability.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Why Signatures Expire
WalletConnect signature requests have a default timeout. According to the official documentation, a request is valid for 5 minutes by default. If the wallet does not respond within that time, the request automatically becomes invalid and returns error code 4100, "Request expired". This is not the wallet rejecting you. It is a security design at the protocol level — it prevents someone from taking an old signature request you never approved and waiting for hours until you let your guard down, then making you sign it.
Some wallets or DApps extend this expiration time. For example, some support an "extended session" feature that can last up to 7 days. But in normal use, the timeout you encounter is usually those 5 minutes.
Check These Three Things Before Requesting Again
1. Confirm the popup content is exactly the same as last time
[What to do]: Check the signature message content. [How to do it]: After the DApp sends the request again, the wallet popup will show the message text or structured data to be signed. Take a screenshot with your phone or compare it word by word with what you saw before. A legitimate DApp should show exactly the same content both times. [Completion standard]: The message content shown in the wallet popup, whether readable text or a hash starting with 0x, is identical to the previous request, with no new fields or garbled text.
Risk warning: If the second popup shows a string of hexadecimal characters you cannot understand at all, while the previous one was readable English, be careful. The DApp may have been tampered with, or you may be on a phishing site. Reject it directly. Do not sign.
2. Confirm you are still on the same website
[What to do]: Check the browser address bar. [How to do it]: Look at the full domain name of the current DApp, including the subdomain. Some phishing sites will pop up a fake signature request right after the signature expires, using a domain that differs from the real one by only one letter. [Completion standard]: The domain is exactly the same as when you first made the request. If you cannot remember it, open the DApp's official link again from your bookmarks or an official channel, and start the connection and signature from there.
3. Do not confuse "signature expired" with "session expired"
A signature request timing out is not the same as your wallet connection session timing out.
Signature request expired: After 5 minutes, the DApp did not receive your signature and gave up. If you click to sign again, the wallet will show a new request.
Session expired or disconnected: The DApp page shows "Disconnected" or your address disappears. In this case, if you try to sign directly, the wallet may not show a popup. You need to reconnect the wallet first and then try again.
If you are in the second situation — reconnecting after a disconnect and then signing — pay extra attention: when reconnecting, confirm that you are granting "signature" permission, not "unlimited token approval". Some DApps wrap a signature request inside the reconnection flow as an "approve" action. If you click too fast, you may grant permissions you should not have given.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
One Situation Where You Must Reject
GitCoin's Passport project once had a reported issue: after a user's session expired and they returned to the page, the wallet automatically popped up a signature request without any active click from the user. This is a textbook example of blind signing risk — you have no idea what you are signing, and the popup appears just because the page refreshed.
If the same thing happens to you — a popup appears automatically after a page refresh or when you switch back, asking for a signature without any active click on "Connect" or "Sign" — reject it directly. Reload the page, manually find the "Connect Wallet" or "Sign" button, and only trust a request that you actively triggered.
