What is a permit signature?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
A permit signature grants a token allowance through a signature alone, with no transaction. Because it costs nothing and the prompt resembles a login, the risk is easy to miss. A permit is not a login — it is authority to move your balance, and signing one unread is how funds get taken.
Key points
- Grants a token allowance by signature alone
- Costs no fee and leaves no transaction in your history
- Its meaning is entirely different from a login signature
- The cap and the deadline are written in the message
Definition
A way to grant a token allowance by signature instead of sending an approve transaction. Defined in EIP-2612 and related standards, the signed message includes the spender, the cap, a deadline and a nonce.
Swapping a token on a DEX first requires allowing the contract to pull that token. Traditionally that meant sending an approve transaction, which costs a fee and turns one action into two. A permit replaces that approval with a signature.
The signed message names the spender, the maximum amount, a deadline and a nonce that prevents reuse. Whoever receives the signature submits it to the contract to establish the allowance. They pay the fee, so nothing appears in the signer's own transaction history.
That is exactly where the danger lies. It looks like a login signature and costs nothing, so caution does not kick in — yet what it establishes is permission to move your balance. Sign a message whose cap is your entire holding and whose deadline is effectively unlimited, and the other side can withdraw whenever it likes.
Watch out for
- · A permit is not a login but authority over your balance — signing unread loses funds
- · Reject any message whose cap is your whole balance or whose deadline is absurdly far out
- · Signatures leave no transaction trail, so review granted allowances in your wallet separately