Signature Phishing in Web3: Principles Analysis and Preventive Measures

Recently, "signature phishing" has become one of the most favored scam methods among Web3 hackers. Despite ongoing awareness efforts by security experts and wallet companies, many users still fall victim every day. One of the main reasons for this phenomenon is that most people lack an understanding of the underlying logic of wallet interactions, and the learning curve is quite high for non-technical individuals.

In order to help more people understand this issue, this article will explain the underlying logic of signature phishing in an easy-to-understand way.

Two Ways to Operate a Wallet

When using a Web3 wallet, we mainly have two operations: "signature" and "interaction."

• Signature: Occurs off the blockchain (off-chain), no Gas fee is required.
• Interaction: Occurs on the blockchain (on-chain) and requires payment of Gas fees.

Signing is usually used for authentication, such as logging into a wallet or connecting to a DApp. This process does not affect blockchain data, so there is no need to pay a fee.

Interaction involves actual blockchain operations. For example, when exchanging tokens on a certain DEX, you first need to authorize (approve) the smart contract to use your tokens, and then execute the actual exchange operation. Both steps require paying Gas fees.

Common Phishing Methods

1. Authorized Phishing

This is a traditional Web3 phishing technique. Hackers create a seemingly legitimate website to lure users into authorizing actions. When users click on buttons like "Claim Airdrop," they are actually authorizing the hacker's address to use their tokens.

2. Permit signature phishing

Permit is an extended feature of the ERC-20 standard that allows users to approve others to use their tokens through a signature. Hackers can induce users to sign such permits and then use the signature to transfer the user's assets.

3. Permit2 signature phishing

Permit2 is a feature launched by a certain DEX to simplify user operations. It allows users to authorize a large amount at once, after which they only need to sign to make transactions. However, if a user has previously used that DEX and granted unlimited authorization, a hacker could exploit this mechanism to transfer the user's assets.

Preventive Measures

1. Cultivate security awareness: Carefully check the operations you are performing each time you conduct wallet operations.

2. Asset separation: Separate large funds from the wallet used for daily transactions to reduce potential losses.

3. Learn to recognize the signature formats of Permit and Permit2: Be wary of signature requests that contain the following fields:

   • Interactive
   • Owner (Authorized Party Address)
   • Spender (Authorized Party Address)
   • Value (Authorized Quantity)
   • Nonce (random number)
   • Deadline

By understanding the principles of these phishing methods and taking appropriate preventive measures, users can better protect the security of their digital assets. In the Web3 world, staying vigilant and continuously learning is crucial.