What should you do before signing a transaction?

Every time your wallet asks you to "sign" something, you're authorizing an action on the blockchain. A bad signature can drain your wallet.

What does "signing" mean?

When you sign:

• You authorize a specific action
• The action is irreversible
• The smart contract will execute exactly what you signed

1. Your wallet tells the contract: I want to do X
2. The contract responds: sign to do X
3. You sign
4. X executes
   and from here it is irreversible

Types of signatures

1. Simple transactions

Sending ETH/tokens from your wallet to another address.

Send

Amount0.5 ETH

To0x71C765…976F

Gas0.001 ETH

RejectConfirm

Verify:

• Correct address (compare several characters)
• Correct amount
• Correct network

2. Approvals (Approve)

Let a contract move your tokens.

! Approve access to USDC

This site wantsTo spend your USDC

AmountUNLIMITED

With this, the contract can spend your USDC whenever it wants, without asking you again.

RejectApprove

Unlimited approvals

Many dApps ask for unlimited approval for convenience. This means the contract can move ALL your tokens of that type, at any time.

If the contract gets hacked or is malicious, you lose everything.

Best practice:

• Approve only the amount you're going to use
• Revoke approvals regularly at revoke.cash

3. Message signatures (Sign)

They don't cost gas, but they can authorize dangerous actions.

Sign message

MessageLogin to OpenSea

RejectSign

Message signatures can be for:

• ✅ Logging into a site (harmless)
• ⚠️ Listing an NFT for sale (watch the price)
• ❌ Authorizing a token transfer (dangerous)

Not costing gas doesn't mean it's harmless

This is the confusion that modern drainers exploit, and that's why it's worth repeating: a gasless signature can drain your wallet.

Keep reading.

3b. Permit and Permit2: the signatures that drain wallets

The Permit (EIP-2612) and Permit2 standards let you approve tokens with an off-chain signature, with no transaction and no gas. They're convenient, and many legitimate apps use them — Uniswap, among others.

The problem is the mental model: people learned that "signing a message is safe because it doesn't cost gas," and these signatures break that rule completely.

! Signature required

TypePermit2

TokenUSDC

Spender0x9f8a…21c4 who is this?

Amountunlimited

Deadline2099 — forever

It doesn't cost gas — which is why you let your guard down. But it authorizes just like an approve.

RejectSign

If you sign that on a fake site, the attacker has a valid authorization to move your tokens whenever they want. There's no transaction of yours to review afterward: the theft happens when they decide to execute it.

What to check before signing a Permit:

Field	What to check
Spender	Is it the contract of the app you're on? If you don't recognize it, reject
Amount	Unlimited? Lower it if your wallet allows
Deadline	A far-off date is an almost eternal authorization

It doesn't show up on revoke.cash the same way a normal approve does

Permit2 signatures are managed separately. Also check your Permit2 permissions on revoke.cash, not just the classic approvals.

General problem: the format of these signatures isn't always readable. If your wallet shows you a block of data you don't understand and you're on a site you reached through a link, reject.

4. Contract interaction

Calls to smart contract functions.

Interact with contract

Contract0xABC…DEF

Functionswap

tokenInUSDC

tokenOutETH

amountIn1000

RejectConfirm

Verify:

• Is the contract the dApp's official one?
• Does the function do what you expect?
• Are the parameters correct?

Checklist before signing

The seven points. If any of them fails, reject — you can always try again.

• I am on the right site: I verified the URL, I got here from a bookmark
• I recognize this contract or this dApp
• The action the screen describes is the one I want to do
• The amount is correct
• The destination address is correct
• The gas is reasonable for this network
• If it is an approval or a Permit: the amount is limited, not unlimited

0 of 7

Protection tools

Wallets with simulation

Some wallets simulate the transaction and show you what will happen:

Wallet	Simulation
Rabby	✅ Shows balance changes
Phantom	✅ Basic simulation
MetaMask	⚠️ Limited

Rabby, for example, shows you:

Transaction simulation

USDC−1,000

ETH+0.5

Expected changes for a swap. If something you didn't ask for shows up here, reject.

RejectConfirm

Security extensions

Extension	Function
Wallet Guard	Alerts about malicious sites
Pocket Universe	Simulates transactions
Fire	Analyzes what you're signing

Contract verification

Before interacting with a new contract:

1. Look up the address on the block explorer (Etherscan, etc.)
2. Is it verified? (code visible)
3. Is it the project's official contract?
4. How many transactions does it have? (new contracts = more risk)

Red flags 🚩

Don't sign if:

• The site is rushing you ("sign fast or you'll lose the opportunity")
• The URL looks suspicious
• It came to you via an unsolicited DM
• It asks to approve an unlimited amount for no reason
• You don't understand what you're signing
• The contract is very new with no history
• Your wallet warns you of danger

If you signed something bad

Act fast:

1. Revoke permissions at revoke.cash
2. Move funds to a new wallet if necessary
3. Stop interacting with the malicious site

If it's too late:

• Blockchain transactions are irreversible
• Document what happened
• Report the scam
• Learn for next time

Summary

• Every signature is potentially irreversible
• Verify URL, contract, amount, and address
• Avoid unlimited approvals
• Use wallets with simulation (Rabby)
• If something feels wrong, don't sign
• If you make a mistake, revoke permissions immediately

---

If you came looking for something else:I'm about to receive crypto · I want to cash out to local currency · Start from the beginning