Crypto glossary
Permit signature (EIP-2612, Permit2)
A permit signature is an off-chain message that authorises someone to spend your tokens, replacing an on-chain approval; drainers often abuse it in phishing.
A standard ERC-20 approval is an on-chain transaction that costs gas. EIP-2612 added a permit function to tokens that support it: the holder signs a typed EIP-712 message stating the spender, amount and deadline, and anyone can submit that signature to set the allowance. Permit2, a contract released by Uniswap Labs, extends the idea to any token: the user approves Permit2 once, then grants individual apps time-limited allowances by signature.
Permits cut steps and fees: an app can bundle approval and swap in a single transaction, and many DeFi front ends and aggregators rely on Permit2 today. For users, signing a message feels lighter than sending a transaction, which is exactly what makes it attractive to scammers.
A permit signature is as powerful as an approval, yet nothing happens on-chain until the attacker uses it, so no gas warning or pending transaction alerts the victim. Wallet drainers ask victims to sign permits on fake airdrop or mint pages, then move the tokens. Users should read the spender and amount before signing and revoke unused Permit2 allowances.
Example
A fake airdrop page asks a user to sign a message to claim; it is actually a Permit2 signature, and minutes later the attacker transfers all of the user's USDC.