Permit signature phishing and why it bypasses approval transactions
Most users who have been warned about crypto phishing know the standard advice: never sign an unlimited token approval transaction. That advice is correct but incomplete. A different attack vector, permit signatures, bypasses the on-chain transaction entirely.
Standard token approvals work through the approve() function on ERC-20 tokens. You sign a transaction. The transaction gets broadcast to the network. You pay gas. The smart contract updates its allowance mapping on-chain. This process is visible. It is auditable. It should always raise a flag when you see an infinite allowance.
Permit signatures work differently. They use ERC-2612, an extension of the ERC-20 standard. DAI was an early adopter. Many DeFi tokens now support it. The permit function lets you authorize a token spend via an off-chain signature. No transaction is broadcast. No gas is paid by the user. The signature is a signed message, not an on-chain transaction.
The attacker collects your off-chain permit signature. They then call the permit function themselves, paying their own gas, to set the allowance on-chain in one step. The victim sees only a MetaMask or WalletConnect signing prompt. It looks like a message request, not a transaction. The wallet might show "TypedData" or "Sign" rather than the red "Send" button users are trained to fear.
The prompting wording that should trigger suspicion includes any message that requests a "deadline" and a "v,r,s" signature component. Watch for language like "Sign this permit to swap tokens" or "Allow this dApp to use your tokens." When the deadline is far in the future, treat it as a red flag. An attacker will set a deadline days or weeks out to give themselves a wide window to execute the permit.
The critical point: a permit signature can authorize unlimited spending of any token the contract holds that supports ERC-2612. The signature alone is enough. The token never leaves your wallet until the attacker calls the permit function. Your wallet balance shows no change. No transaction history records the permit event.
How do permit phishing attacks work in practice? A fake site, a compromised Discord webhook, or a malicious Google ad directs you to a page. The page asks you to "connect" to a dApp. Instead of asking for a standard approval transaction, it pops a signature request. The request payload contains the permit details. You sign. The attacker now has a fully valid permit signature. They can use it at any time before the deadline expires.
The protection is identical to standard phishing avoidance: verify URLs, question every signature request, and never sign permits for sites you cannot fully trust. But there is a specific extra step. Before signing any off-chain message that looks like a permit, check the "data" field in your wallet. A permit signature will contain permit(address owner, address spender, ...) or similar ABI-encoded data. If the spender address is a contract you do not know, do not sign.
Hardware wallets add some protection. A hardware wallet cannot sign typed data for a permit automatically; it usually shows the raw bytes. That raw display is hard to interpret. Many users sign blindly anyway.
Attackers exploit a knowledge gap. Most users distinguish "sending a transaction" from "signing a message." They believe signing a message is harmless. Permit signatures prove that belief is wrong. A signed message can authorize unlimited token movement when it conforms to the ERC-2612 standard.
The biggest single indicator of a permit phishing attempt: the prompt asks for a signature, not a transaction, but it includes fields like "deadline" and "nonce." Legitimate dApps use permits for gasless swaps. They show clear context. Attackers imitate this flow. The absence of a gas fee and the lack of an on-chain record make permit attacks harder to detect both before and after the fact.
Check what you sign. If the prompt asks you to sign typed data that contains an allowance, a spender address, and a deadline, stop. You are being asked to authorize a token spend. Do not confuse it with a harmless text-only message.
Not financial advice. rabbitechnology.xyz publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.