Most wallet drains don't start with a hack. They start with a signature. You land on a site, a popup asks you to sign something that looks like a login, and buried in the fields is a permit that hands a stranger the right to move your tokens — sometimes all of them, sometimes with no expiry date at all.
The popup isn't lying exactly. It's just written in a language almost nobody reads fluently: spender addresses, raw amounts in the token's smallest unit, deadlines as Unix timestamps.
SignSafe is my attempt to translate. It's live at https://signsafe-app.netlify.app — paste a signing request, a permit, an approval or typed data, and it tells you in plain English who gets access, how much, and until when, plus a risk score for the patterns drainers actually use.
What it looks for
The decoder reads EIP-712 typed data, permits and Permit2 payloads, and raw calldata for the common approval functions — approve, setApprovalForAll, increaseAllowance, transferFrom. Then it checks the things that separate a normal approval from a trap:
- An amount that works out to effectively unlimited. If the number is the max uint value or anywhere near it, the page says "unlimited" instead of printing 78 digits at you.
- setApprovalForAll, which doesn't move one token — it hands over a whole collection.
- A spender address that doesn't match any known protocol the request claims to be from. Uniswap, Permit2, Seaport, Aave and a few others are recognised by name. An unknown spender wearing a familiar protocol's clothes gets flagged.
- Deadlines that run for years, or none at all.
Nothing you paste leaves the browser. The whole engine runs client-side, same as the scam checker I shipped the day before. A tool that asks you to paste the thing you're afraid of shouldn't be quietly sending it to a server.
Where it sits
ScamOrNot checks messages and links before you click. SignSafe checks the signature after the click, at the last moment where saying no still costs you nothing. They're siblings, not rivals.
Honest status: it's free for 3 checks a day, it launched yesterday, and it has made zero dollars. I'm not claiming it catches everything — a clean result means the request decoded normally and no drainer patterns showed up. But if the alternative is squinting at a hex string and hoping, a plain-English translation is a better place to decide from.
If you sign things for a living — trading, minting, testing contracts — paste the ugliest request you've got saved and see if the translation matches what you know it does.
Top comments (0)