imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.
imtoken
中文Download
Home / Signature Requests
Step-by-step guide

Signature Requests

A useful way to approach Signature Requests is to ask three questions: what object is involved, what will the request change, and where can the result be verified? Message signatures can prove account control without sending a transaction. Transaction signatures authorize a specific on-chain state change. Structured-data signatures may contain fields interpreted by contracts. The sections below connect those ideas to account, network, contract, and permission context so that similar-looking information is not mistaken for identical on-chain state.

Before you begin
  • Use a trusted device and network
  • Confirm the active account and network
  • Read the full request before signing
On this pageBefore you begin: Message signatures can prove account control without sending a transactionFirst execution stage: Structured-data signatures may contain fields interpreted by contractsSecond execution stage: Verify the requesting website before signingVerify the result: A “login signature” should not be assumed harmless by defaultCommon mistakes and recovery: Rejecting an unclear signature does not damage the wallet
01

Before you begin: Message signatures can prove account control without sending a transaction

Focus on transaction signatures authorize a specific on-chain state change

First, in Signature Requests, the Before you begin: Message signatures can prove account control without sending a transaction stage should not be reduced to the next button. Message signatures can prove account control without sending a transaction. Transaction signatures authorize a specific on-chain state change. For Signature Requests, the user should ask what every signature proves or changes, then reread the account, network, address, asset, amount, and request summary in the order they will matter on-chain. The goal is to be able to explain what will happen, on which network, and to which target before approval. That discipline is more durable than memorizing where a control appears in one version of an interface.

First follow-up in Signature Requests: after the action described by Focus on transaction signatures authorize a specific on-chain state change, a success message should not be the only evidence used. Structured-data signatures may contain fields interpreted by contracts. Unknown text or opaque hex data deserves extra caution. Keep the public identifiers needed for later review, such as the transaction hash, network, and target address, and verify them through the matching block explorer or wallet record. Remember to manage long-lived permissions separately from one-time transactions. If the result differs from the expectation, establish what has already happened on-chain before attempting another signature or transfer, because a second submission may create a separate action rather than repair the first one.

  • Confirm message signatures can prove account control without sending a transaction.
  • Check how transaction signatures authorize a specific on-chain state change affects the current request.
  • Use structured-data signatures may contain fields interpreted by contracts as a separate verification point.
02

First execution stage: Structured-data signatures may contain fields interpreted by contracts

Focus on unknown text or opaque hex data deserves extra caution

Second, in Signature Requests, the First execution stage: Structured-data signatures may contain fields interpreted by contracts stage should not be reduced to the next button. Structured-data signatures may contain fields interpreted by contracts. Unknown text or opaque hex data deserves extra caution. For Signature Requests, the user should use contract addresses as a strong identity check, then reread the account, network, address, asset, amount, and request summary in the order they will matter on-chain. The goal is to be able to explain what will happen, on which network, and to which target before approval. That discipline is more durable than memorizing where a control appears in one version of an interface.

Second follow-up in Signature Requests: after the action described by Focus on unknown text or opaque hex data deserves extra caution, a success message should not be the only evidence used. Verify the requesting website before signing. Check the active account and network at signing time. Keep the public identifiers needed for later review, such as the transaction hash, network, and target address, and verify them through the matching block explorer or wallet record. Remember to be especially careful with assumptions that arise from similar-looking networks. If the result differs from the expectation, establish what has already happened on-chain before attempting another signature or transfer, because a second submission may create a separate action rather than repair the first one.

  • Confirm structured-data signatures may contain fields interpreted by contracts.
  • Check how unknown text or opaque hex data deserves extra caution affects the current request.
  • Use verify the requesting website before signing as a separate verification point.
03

Second execution stage: Verify the requesting website before signing

Focus on check the active account and network at signing time

Third, in Signature Requests, the Second execution stage: Verify the requesting website before signing stage should not be reduced to the next button. Verify the requesting website before signing. Check the active account and network at signing time. For Signature Requests, the user should make every step answer the question: what am I authorizing?, then reread the account, network, address, asset, amount, and request summary in the order they will matter on-chain. The goal is to be able to explain what will happen, on which network, and to which target before approval. That discipline is more durable than memorizing where a control appears in one version of an interface.

Third follow-up in Signature Requests: after the action described by Focus on check the active account and network at signing time, a success message should not be the only evidence used. A “login signature” should not be assumed harmless by default. Some signatures can later be used by third parties in on-chain workflows. Keep the public identifiers needed for later review, such as the transaction hash, network, and target address, and verify them through the matching block explorer or wallet record. Remember to distinguish a waiting state from a failed state. If the result differs from the expectation, establish what has already happened on-chain before attempting another signature or transfer, because a second submission may create a separate action rather than repair the first one.

  • Confirm verify the requesting website before signing.
  • Check how check the active account and network at signing time affects the current request.
  • Use a “login signature” should not be assumed harmless by default as a separate verification point.
04

Verify the result: A “login signature” should not be assumed harmless by default

Focus on some signatures can later be used by third parties in on-chain workflows

Fourth, in Signature Requests, the Verify the result: A “login signature” should not be assumed harmless by default stage should not be reduced to the next button. A “login signature” should not be assumed harmless by default. Some signatures can later be used by third parties in on-chain workflows. For Signature Requests, the user should start by identifying the active network, then reread the account, network, address, asset, amount, and request summary in the order they will matter on-chain. The goal is to be able to explain what will happen, on which network, and to which target before approval. That discipline is more durable than memorizing where a control appears in one version of an interface.

Fourth follow-up in Signature Requests: after the action described by Focus on some signatures can later be used by third parties in on-chain workflows, a success message should not be the only evidence used. Rejecting an unclear signature does not damage the wallet. After signing, continue reviewing any approval or transaction request that follows. Keep the public identifiers needed for later review, such as the transaction hash, network, and target address, and verify them through the matching block explorer or wallet record. Remember to perform an independent review after submission. If the result differs from the expectation, establish what has already happened on-chain before attempting another signature or transfer, because a second submission may create a separate action rather than repair the first one.

  • Confirm a “login signature” should not be assumed harmless by default.
  • Check how some signatures can later be used by third parties in on-chain workflows affects the current request.
  • Use rejecting an unclear signature does not damage the wallet as a separate verification point.
05

Common mistakes and recovery: Rejecting an unclear signature does not damage the wallet

Focus on after signing, continue reviewing any approval or transaction request that follows

Fifth, in Signature Requests, the Common mistakes and recovery: Rejecting an unclear signature does not damage the wallet stage should not be reduced to the next button. Rejecting an unclear signature does not damage the wallet. After signing, continue reviewing any approval or transaction request that follows. For Signature Requests, the user should do not let a familiar label replace a technical check, then reread the account, network, address, asset, amount, and request summary in the order they will matter on-chain. The goal is to be able to explain what will happen, on which network, and to which target before approval. That discipline is more durable than memorizing where a control appears in one version of an interface.

Fifth follow-up in Signature Requests: after the action described by Focus on after signing, continue reviewing any approval or transaction request that follows, a success message should not be the only evidence used. Message signatures can prove account control without sending a transaction. Transaction signatures authorize a specific on-chain state change. Keep the public identifiers needed for later review, such as the transaction hash, network, and target address, and verify them through the matching block explorer or wallet record. Remember to separate interface cues from verifiable chain state. If the result differs from the expectation, establish what has already happened on-chain before attempting another signature or transfer, because a second submission may create a separate action rather than repair the first one.

  • Confirm rejecting an unclear signature does not damage the wallet.
  • Check how after signing, continue reviewing any approval or transaction request that follows affects the current request.
  • Use message signatures can prove account control without sending a transaction as a separate verification point.

Practical checklist

  • Review message signatures can prove account control without sending a transaction.
  • Review structured-data signatures may contain fields interpreted by contracts.
  • Review verify the requesting website before signing.
  • Review a “login signature” should not be assumed harmless by default.
  • Review rejecting an unclear signature does not damage the wallet.

Continue learning

DApp Connections Token Approvals Smart Contract Interaction