What Signing a Message in a Wallet Means: Transaction vs Signature

What signing a message in a wallet means is one of the most important security questions for anyone taking part in airdrops, because many confirmation windows look harmless and cost no gas, yet their consequences can be the same as sending funds. This article explains how a signature differs from a transaction, which kinds of signatures exist and what to check before pressing the button.

This material is educational and is not financial or legal advice. It does not guarantee protection from loss: attentiveness lowers the risk but does not remove it.

Transaction vs signature: what is the difference

A wallet does two fundamentally different things. They are easy to confuse because both open a window with a «Confirm» button.

• A transaction is an operation sent to the network that changes blockchain state and requires a fee (gas). A transfer, a swap, an approval, a claim: all of these are transactions. The result is visible in the wallet history and in a block explorer.
• A message signature is cryptographic proof that you control an address and agree to a specific text or set of data. By itself it sends nothing to the network and costs no gas.

The absence of gas creates a false sense of safety. A signature is not an action but a consent, and that consent can be presented later. If the signed data means «I allow this address to spend my tokens», anyone holding the signature can submit it to the network and pay the gas themselves. The tokens leave your address even though you never paid a fee and never saw a transaction in your history.

The kinds of signatures you meet most often

1. personal_sign. A signature over plain text. This is how logging in to a site with a wallet works: you are shown a readable message, for example with the site name and a one-time code. It is usually safe as long as the text is clear and contains no words about permissions, transfers or handing over rights.
2. Structured data (EIP-712). The wallet shows not one line but a set of fields: who, what, how much, until when. This is the standard way to sign orders on trading platforms and spending permissions. Such windows are harder to read, but the meaning lives in those fields.
3. Permit. A signature under the EIP-2612 standard lets you allow an address to spend your token without a separate approval transaction. Not every token supports it. The fields to check: spender (to whom), value (how much) and deadline (until when).
4. Permit2. A shared permissions contract used by some applications. You give it an approval once, and after that specific limits are set by signatures. It is convenient, but it means a signature with broad parameters works as a full approval.
5. setApprovalForAll. This is not a signature but a transaction, yet it is often shown in a similar window. It gives the named address the right to move all NFTs of the chosen collection, not just one. It has no expiry or limit until you revoke it yourself.
6. Blind signing. A situation where the wallet shows not decoded fields but a long hexadecimal string or a hash. You cannot read the meaning, and you agree without knowing to what.

How to read a signing window

Before confirming, run through a short list. It takes half a minute and closes most of the typical traps.

1. Where the request comes from. The wallet shows the site domain. It should match where you meant to go. If you arrived through a link from a chat or an ad, first read the article on spotting fake claim sites.
2. What the action is. A login, an order, a token permission, an NFT permission? If the window does not name the action in plain words, that is a reason to stop.
3. Who the recipient is. The spender, operator or to field. An unfamiliar address with no explanation of why it is needed is a bad sign.
4. How much. A specific amount or «unlimited»? For a token, an unlimited value means the address can take the entire balance of that token now and later. For NFTs the equivalent is «all tokens of the collection».
5. For how long. The deadline or expiration field. A permission with no expiry, or one far in the future, stays dangerous for longer.
6. Whether it can be read. If a set of bytes is shown instead of fields, do not sign. Many hardware wallets disable such signatures by default, and you should not enable that setting without real need.

One more rule: no legitimate signature asks you to enter or show a seed phrase. That is not a signature but theft. How to store the phrase and keys is covered in the article on seed phrase storage.

If you already signed, and what to do in advance

A transaction approval stays valid until you revoke it, and it can be seen in the wallet's permission list or in a dedicated service. How to view and revoke such permissions is described in the article on revoking token approvals. Signatures are trickier: a signed permit is not visible on the blockchain until someone uses it, and its validity is set by the deadline field. So the best defence is not signing anything extra.

Practical habits that lower the risk:

• keep a separate wallet with a small balance for experiments with new projects, as described in the article on wallet setup for airdrops;
• do not open claim links from direct messages, comments or ads; go to the project's site yourself;
• if in doubt, reject the request: refusing costs nothing, and you can sign again at any time;
• periodically check the list of active permissions and revoke those you no longer use.

In the CoinDropster catalog every project has a page with its status and key facts, and status changes (Potential, Confirmed, Snapshot, Verification, Reward available or Distributed) are tracked. This helps you see what stage a project is at and whether a claim request can be expected at all: if the status does not imply a distribution, an «urgently verify your wallet» demand raises questions. Checklists in the app keep deadlines at hand so you do not act in a rush. View tracked airdrops →