Most wallet drains don't break any cryptography. They get you to sign something you didn't read. Here's what the common prompts actually do.

transfer(to, amount)

Moves tokens out of your wallet right now. The risk is limited to that amount, and you can see it happen.

approve(spender, amount)

No tokens move now. You're allowing spender to pull up to amount later, as many times as it wants, until the allowance is used up or revoked. "Unlimited" approvals use the max uint256 value and never expire on their own.

permit (EIP-2612)

Same effect as approve, but it's an off-chain typed-data signature instead of a transaction. No gas, and nothing shows up in your transaction history when you sign it. Whoever holds that signature can submit it before the deadline. That's why phishing pages love it: "it's just a signature" sounds harmless.

Permit2

You approve the Permit2 contract once, then grant individual apps allowances by signature, usually with an amount and an expiry. Safer by design, but the same rule applies: read the spender, amount and expiry.

setApprovalForAll (NFTs)

Gives an operator control over every item you hold in that collection, not just one.

Decode before you trust the UI

If you're building or debugging, decode the calldata yourself instead of trusting a label:

import { Interface, MaxUint256 } from "ethers"; const erc20 = new Interface([ "function transfer(address to, uint256 amount)", "function approve(address spender, uint256 amount)", ]); const tx = erc20.parseTransaction({ data: calldata }); console.log(tx.name, tx.args); if (tx.name === "approve" && tx.args[1] === MaxUint256) { console.warn("Unlimited approval to", tx.args[0]); }

Five checks before you confirm

  1. Which function: transfer, approve, permit, or something else?
  2. Who is the spender or operator, and do you recognize that contract?
  3. Is the amount unlimited?
  4. Is there a deadline or expiry?
  5. Is it the chain you expected?

If the prompt says "approve" or "permit" when you expected a simple swap or deposit, stop and find out why.

What's the most confusing signing prompt you've run into? Drop it below.