$megatools --permit-analyzer --client-side

EIP-712 Permit & Phishing Signature Deconstructor

Deconstruct EIP-712 typed data messages, decode Permit & Permit2 signatures, detect infinite allowance wallet drainer scams, and verify secp256k1 signers 100% client-side.

⚡ Load Preset:

📝 EIP-712 Typed Data JSON (Domain + Message + Types)

{
  "types": {
    "EIP712Domain": [
      {
        "name": "name",
        "type": "string"
      },
      {
        "name": "version",
        "type": "string"
      },
      {
        "name": "chainId",
        "type": "uint256"
      },
      {
        "name": "verifyingContract",
        "type": "address"
      }
    ],
    "Permit": [
      {
        "name": "owner",
        "type": "address"
      },
      {
        "name": "spender",
        "type": "address"
      },
      {
        "name": "value",
        "type": "uint256"
      },
      {
        "name": "nonce",
        "type": "uint256"
      },
      {
        "name": "deadline",
        "type": "uint256"
      }
    ]
  },
  "primaryType": "Permit",
  "domain": {
    "name": "USD Coin",
    "version": "2",
    "chainId": 1,
    "verifyingContract": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"
  },
  "message": {
    "owner": "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
    "spender": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045",
    "value": "115792089237316195423570985008687907853269984665640564039457584007913129639935",
    "nonce": 0,
    "deadline": "115792089237316195423570985008687907853269984665640564039457584007913129639935"
  }
}

🔏 65-Byte Signature (r,s,v)

✓ Length: 65 bytes0xf39F...2266

Security VerdictRisk Score: 90/100

🚨 HIGH-RISK DRAINER PATTERN DETECTED

4 security alert(s) requiring attention.

🚨 Infinite / Unlimited Token Approval (MaxUint256)

critical

This signature grants the spender permanent, unrestricted permission to transfer ALL of your tokens from this contract, including any future tokens deposited.

Recommendation:Only approve infinite allowance to battle-tested routers (Uniswap, 1inch). For third-party or unfamiliar dApps, approve only the exact transaction amount.

⏳ Perpetual Signature (Never Expires)

high

The signature has no expiration date (or expires decades in the future). The spender can hold this offline signature and drain your wallet at any time later.

Recommendation:Ensure deadlines are tightly bound (typically 10-30 minutes from transaction creation).

🔍 Unverified Third-Party Spender Address

medium

The spender (0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045) is an unindexed contract or EOA wallet.

Recommendation:Inspect the spender on Etherscan or block explorer before signing.

✅ Secp256k1 Signer Successfully Verified

safe

Recovered signer address matches declared owner: 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266.

Recommendation:Cryptographic signature matches the EIP-712 digest.

$ cat tips.txt

Client-Side • EIP-712 & Secp256k1 Deconstructor

How to Use

1Paste any raw EIP-712 typed data JSON or pick a curated real-world preset (ERC-2612 Drainer, Uniswap Permit2, Seaport)
2Optionally input a 65-byte raw signature hex (r, s, v) to cryptographically recover the signer address
3Review the Security Risk Scorecard and Human-Readable Intent Card to confirm what tokens or permissions are granted
4Inspect canonical domainSeparator, structHash, and final EIP-712 digest values for smart contract verification

Stats

Primary Type:Permit

Security Risk:critical (90/100)

Signer Status:Owner Match

Network:Ethereum Mainnet

Tips

•Always inspect the spender address; malicious drainer websites impersonate official dApp frontends to request MaxUint256 approvals
•Check the expiration deadline; perpetual deadlines (e.g. year 2099 or MaxUint256) allow attackers to drain tokens at any future time
•Legitimate EIP-712 typed data should always specify a valid verifyingContract and chainId to prevent replay attacks

Example

Input

{"primaryType":"Permit","message":{"owner":"0x742d35...","spender":"0xd8dA6B...","value":"115792..."}}

Output

Risk Verdict: CRITICAL (90/100). Infinite token allowance detected. Spender 0xd8dA... not a known protocol router.