Not every signature does the same thing
A login message proves control of an address. A token approval permits a contract to transfer assets within its allowance. A transaction changes blockchain state. Read which category the prompt belongs to.
Phishing changes the context
A malicious interface can present a familiar story while requesting a different domain, contract, network, asset, or allowance. Bookmarks and verified links reduce dependence on search advertisements and copied domains.
Use a deliberate signing routine
Stop if the requested action differs from the one you initiated.
- Confirm the domain
- Confirm network and contract
- Limit allowances when practical
- Reject unexplained typed-data prompts
- Never enter a seed phrase into a website
Translate the prompt into authority
A login signature may prove control of an address. Typed data may authorize an order or delegated key. A token approval can let a contract transfer assets later. A transaction can immediately alter onchain state. The safe question is not ‘Is this only a signature?’ but ‘What authority does this exact payload grant?’1
Human-readable clear signing aims to show the intended domain, contract, function, asset, amount, recipient, and chain before confirmation. If a wallet cannot explain the effect, use an independent decoder or stop. Branding and a familiar logo are not evidence that the payload is safe.1
Recovery after a suspicious prompt
Reject the request, close the page, return through a known bookmark, and inspect recent transactions and allowances from a trusted tool. If something was signed, revoke affected permissions and move remaining assets only after confirming that the destination and signing device are uncompromised.12