Module 2: Wallets, Custody, and Security
Reading What You Sign
Chapter 7 of 14 · about 6 minutes
7.1 "It was only a signature"
Mint saw a post about a free token claim for early users of a popular application. Mint connected the wallet to the claim site, and a pop-up appeared asking for a signature. It didn't cost any gas, so it seemed harmless. Mint clicked "Sign."
Nothing happened. No tokens arrived. Mint shrugged and moved on.
The next morning, the wallet's stablecoins were gone.
"But I didn't send anything," Mint said. "I only signed a message."
Hash looked at the transaction history. "That message gave someone permission to take your tokens. They came back later and used it."
This chapter is about the most important habit in self-custody: understanding what you're signing before you sign it. As Chapter 1 explained, the blockchain only checks signatures. It doesn't care whether you meant it.
7.2 Two kinds of requests
When an application asks your wallet for something, it's usually one of two things.
A transaction is an action recorded on the blockchain: sending tokens, swapping, approving a contract, depositing into a protocol. It costs gas and takes effect when it's confirmed.
A signature request (or message signature) is a signed message that isn't broadcast to the blockchain by your wallet. It costs no gas. Many are harmless, such as proving you own an address to log in. But some signed messages can be submitted later by someone else, as permission to move your assets.
"So free doesn't mean safe," said Mint.
"Some of the most dangerous things you can sign are free," said Hash.
Chapter 7 · Reading what you sign
A wallet request branches into two kinds. A transaction pays gas and executes on-chain immediately. A message signature pays no gas but can authorise a token transfer or login later, which is how permit-style approvals are abused.
7.3 The main types of requests
| Request type | What it does | Risk level |
|---|---|---|
| Simple transfer | Sends a specific amount of a token to a specific address | Low, if the address and amount are right |
| Sign-in message | Proves you own an address, often in readable text like "Sign in to example.com" | Low, when the text is readable and the domain matches |
| Token approval | Gives a smart contract permission to move your tokens (Chapter 8) | Medium to high, depending on the contract and amount |
| Permit signature | An off-chain signature that grants a token approval, with no gas cost | High: free to sign, but can authorise spending of your tokens |
| Marketplace order | Signs an order, for example listing an NFT or tokens for sale at a price | High if the price or items aren't what you expect |
| Setting approval for all | Lets a contract move all your NFTs in a collection | Very high if the contract isn't trusted |
| Account delegation | Lets your account run a smart contract's code, enabling smart account features | Very high if the contract is malicious; it can control your whole account |
| Raw data or unreadable hash | A signature you can't read at all | Extremely high. Reject unless you know exactly why it's needed |
Account delegation deserves a note. A 2025 Ethereum upgrade allowed regular accounts to adopt smart account features by delegating to a smart contract. This enables useful things, like batching transactions, but scammers quickly started tricking people into delegating their accounts to malicious contracts. Only approve delegation through a wallet you trust, for a purpose you understand.
7.4 What happened to Mint
Let's look at what Mint actually signed. It was a permit signature. In plain language, it said:
| Field | Value Mint signed | What it meant |
|---|---|---|
| Token | USDC | The token being approved |
| Owner | Mint's address | Whose tokens |
| Spender | An unknown address | Who gets permission |
| Value | An extremely large number | Permission to take any amount, effectively unlimited |
| Deadline | Many years in the future | The permission stays valid for a long time |
Mint's wallet displayed these fields, but Mint didn't read them. The scammer took the signature, submitted it to the blockchain, and then transferred all of Mint's USDC. Because Mint paid no gas and saw no on-chain activity at the time, nothing seemed wrong until the funds were gone.
"Why would a free claim need permission to spend my USDC?" Node asked.
"It wouldn't," said Hash. "That's the question Mint should have asked."
7.5 The five questions
Before signing anything, Hash taught Mint to ask five questions.
- Where am I? Is this the real website? Check the exact domain in your browser and in the wallet pop-up. Scam sites use lookalike domains with an extra letter or a different ending.
- What type of request is this? A transfer, approval, permit, order, delegation, or something you can't read?
- What assets does it touch? Does it involve tokens or NFTs that have nothing to do with what you're trying to do?
- Who gets permission or funds? Is the recipient or spender the contract you expect, or an unknown address?
- Does it make sense? Does this request match what you clicked? A free claim shouldn't need to spend your stablecoins. A login shouldn't need an approval.
If you can't answer all five, don't sign. Closing the pop-up costs nothing.
7.6 Simulations and warnings
Many modern wallets and security tools offer transaction simulation. Before you sign, they simulate what would happen and show a preview: "You will send 500 USDC" or "You will receive 0.1 ETH." Some also flag known malicious addresses, suspicious websites, and dangerous signature types.
Treat these tools as a valuable safety net, not a guarantee. Simulations can't always predict permissions that will be used later, and attackers keep developing new tricks. If a warning appears, take it seriously. If no warning appears, still ask the five questions.
7.7 Pressure is a signal
Most malicious signature requests come with urgency. "Claim in the next 10 minutes." "Only 50 spots left." "Your wallet will be suspended unless you verify." Urgency exists to stop you from asking the five questions.
Hash's advice was simple: "Legitimate opportunities can wait for you to read. Scams can't."
7.8 Practical habits
Use a burner wallet with little in it for new or unknown sites, as Chapter 2 described. If it's drained, the loss is small.
Navigate from bookmarks, not links in messages, comments, or ads.
Read pop-ups fully, including scrolling down. Important details are often below the first screen.
Be most cautious with free things. Airdrops, claims, and mints are the most common lures.
Reject anything unreadable. If your wallet shows raw data or an unreadable hash, and you don't know exactly why, reject it.
7.9 Try it yourself
On a testnet, connect a burner wallet to a decentralised exchange and start a token swap. When the wallet pop-up appears, don't confirm it straight away. Identify the type of request, the token involved, the spender or recipient, and the amount. Then confirm it and look up the transaction on a block explorer to see whether it matched what you read.
Next, look up the transaction simulation features of the wallet you use. Does it show a preview of balance changes before you sign?
Key takeaways from this chapter
- The blockchain only checks signatures, not intentions. If you sign it, it counts.
- Transactions cost gas and act immediately. Signature requests are free, and some can be used later to move your assets.
- Permits, marketplace orders, approval for all, account delegations, and unreadable signatures carry the highest risk.
- Before signing, ask: where am I, what type of request is this, what assets does it touch, who gets permission, and does it make sense?
- Use simulations and warnings as a safety net, not a substitute for reading.
- Urgency is a warning sign. Legitimate requests can wait for you to read them.
- Use a burner wallet for unknown sites, navigate from bookmarks, and reject anything you can't read.