DAOrayaki: Risk comparison of four signature types without Gas

特邀专栏作者

2022-12-24 16:00 (UTC+8)

This article is about 1080 words, reading the full article takes about 2 minutes

In this article, we will introduce four types of message signatures (gas-less signatures) to help users understand the risks associated with signing messages on Ethereum or other EVM-compatible blockchains.

AI Summary

Expand

Original Title: Safe Signing 101

If users can interact freely without paying high gas fees, Web3 will be used on a large scale. Therefore, gas-free transactions are given a lot of expectations. But there are many misconceptions about gasless signatures. In this article, we will introduce four types of message signatures (gas-less signatures) to help users understand the risks associated with signing messages on Ethereum or other EVM-compatible blockchains.

Four Types of Signatures

These signature types are absolutely critical to all Etherean in web3.

Type #1 - Proof of Identity (Security)

This is primarily what signatures in web3 are for. While there is no uniform standard, some common items include terms of service, wallet address, sometimes a nonce to prevent replay attacks, and possibly a short string to ensure that the information you sign on the software wallet is the same as in the It is the same on hardware wallets. Concrete example:

Type #2 - Type signature [smart contract interaction] (use with caution)

Often, some parts of a smart contract rely on off-chain signatures for implementation. These types of signatures will break all inputs that will be part of the contract interaction. Very handy, but needs to be careful if you have public approval. As we discussed in our approval article, while you can tell exactly what they're doing in this example, you need to make sure that the sources showing these types of signed requests are reputable.

For example, if you get a signed approval request as shown outside of Opensea, you should be very careful and never sign it.

Type #3 - obfuscated hex signature (be careful!)

Now just because something doesn't have fancy type signatures that conform to the aforementioned EIP-712 standard, doesn't mean it's a scam. However, it does mean that you are trusting the other person, no matter what type of information you are signing, because you are basically"blind sign"a message. We don't see these levers on Opensea these days due to the upgrade of the Seaport contract, but I would still pause before signing off on these types of messages, especially wallet addresses with public approval.

Type #4 - ETH_Sign - Obsolete and kinda scary (dangerous!)

This is a very dangerous type of signature, basically a "blank check" for Ethereum. Requesters can use it to sign any transaction with your private key. The good news is that Metamask will display a big red warning if requested. It effectively allows someone, if they craft a signed payload correctly, to be able to "replay" a transaction for their own benefit, such as sending ETH to themselves. This is not dependent on approval like stolen wETH, NFT and other tokens. This is the only type of signature that presents this risk, as very few services use it legally and should generally be avoided at all costs!