Signature request decoder
NewThe request
What it catches
- Permit2 signatures that approve several tokens at once, with no expiry
- Marketplace listings that pay you nothing, or next to nothing
- setApprovalForAll and unlimited approvals, and who they go to
- Requests signed for another chain, or a contract that is not what the domain claims
- Addresses that imitate Permit2, Seaport or each other
- Messages that hide a hash or calldata behind a “free login”
Every decoded field shows where its meaning comes from: the function’s ABI or the EIP-712 type.
Decoded in your browser: EIP-2612 and DAI permits; Permit2 allowances, batches and transfer signatures; Seaport orders and bulk listings; Blur orders; Safe transactions (check the queue with the Safe transaction checker); Sign-In with Ethereum; and approve, increaseAllowance, setApprovalForAll and transfer calls, opened inside multicall, Multicall3, smart-account execute, MultiSend and Uniswap Universal Router batches. Unknown functions are named from a list bundled with the page; nothing is fetched from third parties.
Questions
Is what I paste sent to Wardcrest?
No. Decoding runs in your browser. To label the addresses a request names, the page sends only those addresses and the chain to Wardcrest, which looks them up and keeps nothing. The request itself never leaves your device.
Where do I find the request to paste?
Many wallets show the raw data of a request or let you copy it. Developers can copy it from the browser console, where the site calls eth_signTypedData_v4, personal_sign or eth_sendTransaction; paste the whole call and Wardcrest unwraps it. For a transaction, the "to" address and the "data" field are enough, and a raw serialised transaction works too.
Why is a signature risky if it costs no gas?
A permit, a Permit2 approval or a marketplace listing is a promise the other side can submit on-chain whenever it likes. It moves your tokens without another prompt from your wallet, and nothing shows in your history until then. Most wallet drains now start with a signature rather than a transaction.
Does no red flag mean I can sign?
It means the request does not match a pattern of theft Wardcrest knows. Wardcrest cannot tell whether the site is who it claims to be, or whether a listing price is fair, because it has no NFT prices. Compare every address and amount with what you expect.
How do I undo an approval I already signed?
An ERC-20 allowance stays until you set it to zero; the token approvals checker lists yours and shows how to revoke them from your own wallet. An NFT operator is removed with setApprovalForAll set to false. A signature that has already been used cannot be undone.