eth_sign & Permit2 Signature Poisoning: How Malicious DApps Drain Wallets Without Gas

The Evolution from Gas Approvals to Gasless Signatures

In early crypto phishing, attackers relied on standard on-chain setApprovalForAll transactions, which prompted clear wallet warning screens and required gas fees. Modern Web3 drainers employ Off-Chain Cryptographic Signatures (EIP-712 and Uniswap Permit2) to silently siphon tokens.

The Dangerous Vectors: eth_sign vs Permit2

• Blind eth_sign Exploits: Signs an arbitrary 32-byte hexadecimal hash without decoding what contract function or transaction is being authorized. It can authorize a full wallet asset transfer.
• Uniswap Permit2 Approval Hijack: Permit2 allows users to manage token approvals across different DApps with single off-chain signatures. Drainers present a fake "Claim Airdrop" popup that actually signs a Permit2 payload granting the drainer contract full transfer authority.
• Zero Gas Required from Victim: The attacker takes the signed cryptographic payload and submits it to the blockchain via their own relayer node, paying the gas fee to pull your tokens.

How to Guard Your Web3 Wallet

1. Enable Block eth_sign in MetaMask / Phantom advanced security settings.
2. Use transaction simulation extensions (e.g., Pocket Universe or Wallet Guard) to preview asset changes before signing.
3. Regularly review and revoke stale smart contract allowances at revoke.cash.

Review our report on Web3 wallet drainers and IP fingerprinting tactics.

Check your browser connection security and inspect your outward IP on our free Web3 network inspector.