Safe Signing: How to Read Transaction Prompts

Every drainer attack ends at the same moment: a user clicks "Confirm" on a wallet prompt. Before that click, nothing is lost. Learning to read prompts is one of the most valuable security skills in crypto, and it takes only a few minutes to learn the basics.

Two kinds of requests

Wallets show two main kinds of requests:

• Transactions change something on-chain, such as sending tokens, approving spending or interacting with a contract. They usually cost gas.
• Signatures sign a message off-chain. Some are harmless login messages. Others, such as token permits, can grant spending rights without any gas fee.

The absence of a gas fee does not mean a request is safe. Some of the most damaging signatures cost nothing.

Common transaction prompts

Prompt	What it does	When it is normal
Send	Transfers native tokens	Paying someone directly
Transfer (token)	Sends tokens to an address	Paying a merchant
Approve	Lets a contract spend your tokens	Before a swap or deposit you initiated
Increase allowance	Raises an existing approval	Rarely needed
Set approval for all	Gives control over all NFTs in a collection	Listing on a known marketplace
Contract interaction	Calls a function on a contract	Using a dApp you trust

For each prompt, ask whether it matches what you are trying to do. A payment should be a plain transfer, and an approval request during checkout is a warning sign.

Reading approvals

When a prompt asks for an approval, check:

1. The token. Is it the token you intend to use?
2. The spender. Is the contract address the official one for the app?
3. The amount. Is it limited to what you need, or unlimited?

Many wallets let you edit the amount. Reduce unlimited approvals to the amount needed for the current action.

Reading signatures

Signature requests vary:

• Plain text messages, such as "Sign in to example.app", are usually login requests. Check that the domain in the message matches the site.
• Structured data signatures show fields. Look for words such as permit, spender, value, deadline or nonce. These can authorise spending.
• Unreadable data shown as long hexadecimal strings is a warning sign, especially on unfamiliar sites.

If a site you just visited asks for a permit signature while claiming to verify your wallet, stop.

Warning signs

Reject a request if:

• It asks for an approval when you expected to receive something
• The spender address is unfamiliar and not listed on the official site
• The site pressures you with countdowns or urgent warnings
• The wallet shows a security warning or simulation result indicating asset loss
• You cannot understand what the request does
• The request appears on a site reached through a DM, reply or ad

Use simulation and warnings

Many wallets and extensions simulate transactions and show expected balance changes before you sign. If a simulation shows tokens leaving your wallet unexpectedly, reject the request. Simulations miss some attacks, yet they catch many common drainers.

Hardware wallets add another layer by showing details on a trusted screen. Read the device screen as well as the computer screen.

Build a habit

A simple habit prevents most losses:

1. Pause before every confirmation
2. Read the type of request
3. Check token, spender and amount
4. Confirm the site is the official one
5. Reject anything unclear

It feels slow for a week, then becomes automatic.

Payments should be simple

A legitimate payment is usually a plain token transfer to a published address. Proud Globe orders, for example, never ask for approvals or signatures: the order page shows the exact amount and receiving address, and the optional wallet button only prepares a standard transfer that you can read before confirming.