Wallets & security
A valid signature can approve the wrong action
Cryptographic validity and informed consent answer different questions.
Os artigos de investigação e as referências são publicados em inglês. A navegação está disponível em sete idiomas.
Neste artigo
A signature proves that a key authorised particular data. It does not prove that the person understood the consequences or that the website's description was accurate. Structured signing can make fields easier to inspect, but a readable format is not a guarantee of benign intent.
Match the request to the task
For a login, the domain, account, nonce and time context matter. A login request should not quietly become a spending permission. For a transaction, inspect the destination, assets, amounts and authority changes. A simulation can help explain likely effects, but its coverage and assumptions still matter.
Stop when the requested action does not match the reason you opened the site. A supposed identity check that requires a recovery phrase or broad asset authority is a different operation from authentication.
The distinction also applies to applications handling signatures: the server must validate the intended context, not merely that some signature is mathematically valid. This guide describes defensive requirements, not a method for bypassing a service. See permits for a common source of confusion.
Fontes
- EIP-712: typed structured data signatures
- ERC-4361: Sign-In with Ethereum
- MASTR: Crypto Survival Guide, four original panels
Investigação verificada em 5 de setembro de 2026. Historical cases retain the date and legal status of the cited record.