Wallets & security
A valid signature can approve the wrong action
Cryptographic validity and informed consent answer different questions.
Research articles and reference entries are published in English. Navigation is available in seven languages.
In this article
A signature proves that a key authorised particular data. It does not prove that the person understood the consequences or that the website's description was accurate. Structured signing can make fields easier to inspect, but a readable format is not a guarantee of benign intent.
Match the request to the task
For a login, the domain, account, nonce and time context matter. A login request should not quietly become a spending permission. For a transaction, inspect the destination, assets, amounts and authority changes. A simulation can help explain likely effects, but its coverage and assumptions still matter.
Stop when the requested action does not match the reason you opened the site. A supposed identity check that requires a recovery phrase or broad asset authority is a different operation from authentication.
The distinction also applies to applications handling signatures: the server must validate the intended context, not merely that some signature is mathematically valid. This guide describes defensive requirements, not a method for bypassing a service. See permits for a common source of confusion.
Sources
- EIP-712: typed structured data signatures
- ERC-4361: Sign-In with Ethereum
- MASTR: Crypto Survival Guide, four original panels
Research checked 5 September 2026. Historical cases retain the date and legal status of the cited record.