Permit-style signature phishing#
Last modified: August 10, 2026
Permit-style signatures are wallet messages that can authorize token spending without a separate approval transaction when supported by the token, wallet, or tool. Scammers may use words such as permit, Permit2, signature approval, or authorization to make the request look like a harmless login.
The exact formats available to a user depend on the wallet, token contract, and application. Treat any permit-style request as a request that may grant spending authority.
What it looks like#
A fake site says you need to sign a message to check eligibility for an airdrop. The wallet does not show CTN leaving immediately. In the typed-data details, however, the message authorizes an unknown spender, a token, an amount, and a deadline. The attacker later submits that signed authorization on-chain and drains the approved token.
Warning signs#
- The request mentions permit, Permit2, allowance, spender, operator, or authorization.
- The spender is not a contract you recognize.
- The amount is unlimited or much higher than the action requires.
- The deadline is far in the future or missing.
- The site presents the request as a login, verification, refund, or claim.
- The wallet cannot clearly explain what the signature permits.
Checks before signing#
- Confirm the site through an official source.
- Expand the wallet details and read the spender, token, amount, nonce, and deadline where shown.
- Cancel if the signature grants spending authority when you expected only to sign in.
- Avoid signing permit-style messages from direct messages, ads, claim pages, or fake support.
- After suspicious activity, review token approvals and permit-related permissions using a trusted Centurion-compatible tool.
If you signed a malicious permit-style request#
Stop using the site. Revoke or invalidate the related permission when possible, move assets if funds are at immediate risk, and report the incident. Disconnecting the site does not necessarily cancel a signed authorization.