Checking what a transaction does before you sign
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
Signing is executing. Refuse any signature whose effect you cannot describe. Most wallets now simulate the transaction and show the expected balance changes — all you have to do is check that what it shows matches what you intended.
Key points
- Pre-signature simulation estimates and displays what the transaction would take out
- If anything you did not intend appears on the 'leaving' side, stop there
- Pay particular attention to unlimited approvals and blanket NFT permissions (setApprovalForAll)
- Simulation is not infallible — if you cannot read the result, do not sign
Definition
Estimating, before a transaction is broadcast, how it would change your balances and permissions, and presenting that in the signing prompt.
A blockchain transaction is final the moment it is signed and broadcast. There is no bank to ask for a reversal. That makes the signing prompt your last line of defence — and as long as you approve without reading it, every other measure can be routed around. Read it every time and most drain-style attacks stop there.
Major wallets now simulate the transaction beforehand and list what leaves and what arrives at your address. There is only one thing to check: does that list match what you meant to do? If you intended to buy one NFT and several tokens appear on the outgoing side, stop. If something leaves your wallet during an operation that was supposed to be free, it is not free.
Granting permissions deserves extra care. A token approval moves no balance, but it hands someone standing authority to move your tokens later. An NFT `setApprovalForAll` grants transfer rights over an entire collection. When words like approve, allowance or setApprovalForAll appear, check who is being authorised, for what, and up to what limit — and if your wallet lets you cap the amount, cap it at what you actually need.
Simulation helps but is not infallible. Where behaviour depends on state at execution time, or where a contract is built to hide its effect, the preview and the reality can diverge. And a plain message signature, which is off-chain and shows no balance change at all, can still delegate orders or grant rights. The final test does not change: if you cannot describe what will happen, do not sign.
Watch out for
- · A simulation showing no issues is not a guarantee of safety
- · With a hardware wallet, always verify the destination and amount on the device's own screen
- · The habit of approving without reading is the single biggest weakness
Frequently asked questions
Is a gas-free 'message signature' safe?
No. It costs no gas because it happens off-chain, but depending on its contents it can delegate an order or grant a permission. If you cannot read or understand the message being signed, do not sign it.