A valid signature can approve the wrong action

A signature proves that a key authorised particular data. It does not prove that the person understood the consequences or that the website's description was accurate. Structured signing can make fields easier to inspect, but a readable format is not a guarantee of benign intent.

Match the request to the task

For a login, the domain, account, nonce and time context matter. A login request should not quietly become a spending permission. For a transaction, inspect the destination, assets, amounts and authority changes. A simulation can help explain likely effects, but its coverage and assumptions still matter.

Stop when the requested action does not match the reason you opened the site. A supposed identity check that requires a recovery phrase or broad asset authority is a different operation from authentication.

The distinction also applies to applications handling signatures: the server must validate the intended context, not merely that some signature is mathematically valid. This guide describes defensive requirements, not a method for bypassing a service. See permits for a common source of confusion.

Sources

1. EIP-712: typed structured data signatures
2. ERC-4361: Sign-In with Ethereum
3. MASTR: Crypto Survival Guide, four original panels

Recherche vérifiée le 5 septembre 2026. Historical cases retain the date and legal status of the cited record.