KoinlyticsA traditional Ethereum signature is over a raw hash. Your wallet cannot decode what the hash represents. "Sign this: 0x8a7b6c..." gives you no information. Attackers exploited this constantly by getting users to sign hashes that turned out to be token approvals or asset transfers.
The problem in one example
User sees: "Sign message to prove wallet ownership." Wallet shows: 0x94a3fd... Signature actually authorizes a Permit that grants unlimited USDC approval to an attacker. User has no way to know.
What EIP-712 does
Structures the message. Instead of a raw hash, the signer sees:
- The domain (contract name, chain ID, verifying contract address).
- A typed message with named fields.
- The full structure human-decoded.
The wallet can display: "You are signing a Permit for USDC. Owner: 0xYou. Spender: 0xAttacker. Value: 115792... (max uint256). Deadline: 2050-01-01."
Adoption
- Uniswap V4 signatures.
- OpenSea order signatures.
- Every serious DEX and NFT marketplace.
- Snapshot voting signatures.
What the wallet shows
- MetaMask decodes 712 messages fully.
- Rabby decodes plus adds risk warnings.
- Coinbase Wallet decodes.
- Older / lesser wallets may still just show hex — treat those as blind sign.
Rules for users
- If your wallet does not decode a signature, do not sign it.
- If the signature is a Permit / Permit2 and you did not intend to grant an approval, do not sign.
- Read the domain: signing for a different contract than the dApp you thought you connected to is a red flag.