What does this wallet signature do?
Paste the transaction data or the typed message into a signature decoder and read what it grants: a one time transfer, a standing approval, an off-chain Permit, or control of the whole account. Approvals, Permits and account delegations are the ones that drain wallets, and the Permit kind costs no gas, so nothing warns you before the tokens move.
A wallet popup shows you hex, a contract address and a button. What it rarely shows is the one thing that matters: what the other side can do once you sign. Almost every wallet drain starts with a signature the victim did not understand, so it is worth thirty seconds to find out before you press the button.
Signature Checker Watch 24/7 on Telegram
Public address only. No wallet connection. Nothing to sign.
Four kinds of signature, and only one is harmless by default
Most signature requests fall into four kinds. A transfer sends a fixed amount once and grants nothing afterwards. An approval gives a contract standing permission to move a token from your wallet, often for an unlimited amount, until you revoke it. A Permit or Permit2 message grants the same kind of permission without a transaction at all. An account delegation, the EIP-7702 kind, hands the code at another address control of your entire account. The last three are standing powers, and standing powers are how drainers take what you hold now and anything you receive later.
How to check in about thirty seconds
Copy the data the wallet shows you: the hex data field of a transaction, or the full typed message of a signature request. Paste it into our Signature Checker. It decodes the action, names the spender and the amount, and says in one sentence what signing would let the other side do, with a level of danger, warn or info. If it cannot parse what you pasted, it says so out loud rather than staying quiet, because silence would read as approval. The payload is never stored, and nothing about it requires your wallet.
Why a Permit is the most dangerous one to misread
An approval is an on-chain transaction: it costs gas and appears in your history, so you at least see it happen. A Permit is a signed message. There is no transaction and no gas, the wallet often shows it as a harmless looking signature, and nothing appears on chain until the attacker submits it and the tokens are already moving. Anyone holding the signature can submit it later. That is why an unlimited Permit is reported as danger, and why most modern drainer kits ask for one.
The account delegation that revoking will not fix
EIP-7702 lets an ordinary wallet delegate to smart contract code. A malicious delegation gives that code control of every token, every NFT and any ETH that arrives later. Two details make it worse than an approval. A delegation signed with chain id 0 is valid on every chain at once, which legitimate apps do not need. And revoking token approvals does not undo it, because the delegation sits on the account itself and has to be replaced with a new one. If a site you do not fully trust asks for one, do not sign.
Signs that a request is a drainer, before decoding anything
Some requests are wrong by context. A mint, airdrop or claim that asks for an approval or a Permit on a token you already hold. A site you reached from a reply, an ad or a direct message rather than typing the address yourself. A request for setApprovalForAll on an NFT collection when you only meant to list one item. A signature that the site says is just to verify your wallet but decodes as a Permit. Urgency, a countdown or a claim closing soon. Any one of these is a reason to stop and decode before you sign.
If you already signed something you did not understand
For an approval or a Permit, revoke the permission now, before it is used. Our wallet scanner lists every risky approval across five EVM chains and links each one to a revoke. A Permit2 signature that has not been submitted yet stops working once you revoke the token's approval to the Permit2 contract, and for any kind of Permit, moving the tokens to a fresh wallet is the sure fix. For an account delegation, replace it with a new delegation to a trusted contract or to none. If funds are already moving, move what is left to a fresh wallet whose seed phrase has never touched the compromised device.
FAQ
Can a signature drain my wallet without a transaction?
Yes. A Permit or Permit2 signature is an off-chain message that grants spending permission. It costs no gas and appears nowhere until the holder submits it, at which point the tokens move in the same transaction. That is the most common way wallets are drained today.
Is an unlimited approval always a scam?
No. Many legitimate apps ask for an unlimited approval so you do not pay gas to approve again. It is still a standing permission until you revoke it, so it is only as safe as the contract you gave it to. A capped approval for the amount you are actually spending is the safer shape.
What should I paste into the checker?
For a transaction, the hex data field your wallet shows, which starts with 0x. For a signature request, the full typed message, usually a JSON block with fields like domain, types and message. Wallets show these under advanced or details views.
Does the checker store what I paste?
No. The payload is decoded and discarded. We count only which kind of action was decoded, so we can tell which checks people need most, never the payload itself or who sent it.
Will revoking approvals undo an EIP-7702 delegation?
No. A delegation is set on the account, not on a token, so revoking token approvals leaves it in place. It has to be replaced with a new delegation. Our checker says this in its result for exactly that reason.