Library · Crypto, word by word · Scams and security
What is permit phishing?
Permit phishing is a scam in which a fake site asks you to sign an off-chain message that grants a spending allowance over your tokens. Signing costs no gas and sends no transaction, but whoever holds the signature can submit it and then move your tokens.
What it means for you
Because nothing happens on-chain when you sign, your balance looks unchanged until the attacker acts, which can be much later. Before signing any typed message, read the spender address, the value and the deadline your wallet shows. A Permit request from a site you reached through an ad, a direct message or a surprise token is a warning sign.
A common mistake: “If I only signed a message and paid no gas, nothing can happen to my tokens.”
In fact: A permit signature is a complete authorization. Anyone holding it can submit it on-chain, pay the gas themselves, and set an allowance that lets them move your tokens up to the value you signed.
How it works
EIP-2612 adds a permit function to ERC-20 tokens: the owner signs an EIP-712 typed message naming owner, spender, value, nonce and deadline, and the standard notes that anyone can submit it to the token contract to set the allowance. Scammers build fake sites that request this signature, submit it themselves, then move the tokens. One study of Ethereum phishing classed 6,414 of the 13,877 successful permit transactions it examined as phishing. Unlike an ordinary token approval, which you send on-chain and pay gas for, the permit leaves no trace until it is used.
Sources: EIP-2612: Permit extension for EIP-20 signed approvals, Dissecting Payload-based Transaction Phishing on Ethereum (arXiv) · checked 4 October 2026
Often confused with
Related words
Educational content, not financial advice. Written by hand and checked against the source named above. Something wrong? Tell us and we reply within two business days.