Permit Signature

A permit is a signed message that grants a token allowance without sending a transaction. Introduced so users could approve and spend in one step instead of paying gas twice, it moves the authorisation off-chain: you sign a structured message, and whoever holds that signature can submit it to grant the allowance whenever they choose. That is the security consequence. A permit costs nothing to sign, produces no pending transaction, and does not appear in a wallet's transaction history, so the usual signals that something happened are absent. Drainer sites rely on this: the prompt looks like a harmless login, and the signature it collects is a standing authorisation over a token balance. Read what a signature grants — which token, what amount, which spender, until when — and treat an unlimited amount in a signing prompt the same way you would treat one in a transaction.