Permit Phishing
A scam that tricks a victim into signing a malicious EIP-2612 permit message, granting an attacker token approval without the victim realizing they authorized anything.
Permit phishing is a scam that tricks a victim into signing a malicious off-chain message using the EIP-2612 permit (see Kaavon's "EIP-2612 (Permit)" glossary definition) standard, which grants the attacker a token approval (see Kaavon's "Token Approval" glossary definition) without requiring any visible on-chain transaction at the moment of signing. Because a permit signature doesn't immediately show up as a transaction in the victim's wallet history, and signing requests can be disguised to look routine or unimportant, victims often don't realize they've authorized anything until the attacker later submits the signature to actually move their funds.
This attack specifically exploits the gasless, off-chain nature of permit signatures that make EIP-2612 convenient in the first place — a malicious site can present a permit-signing request disguised as something innocuous, and since no gas fee or on-chain transaction preview accompanies a signature request the way it does for a regular transaction, victims have fewer obvious warning signs to notice compared to being asked to approve a visible, on-chain token approval transaction directly.
Examples
- A permit phishing site might disguise a malicious EIP-2612 signature request as a routine wallet connection step, tricking the victim into unknowingly granting token approval.
- Unlike a standard on-chain token approval, a permit phishing signature doesn't require gas or show up as a pending transaction, giving victims fewer obvious warning signs.