How to read a wallet prompt: connect, sign, send, permit
Connect vs sign vs send vs permit: what each wallet popup means, red flags beginners miss, and how to slow down before confirming.
Browser and mobile wallets show different kinds of confirmation screens. They look similar when you are rushed. Public MetaMask, Ledger, and ethereum.org security materials all emphasize: read the request type before you approve. This page is literacy only—not a recommendation to use any particular app or asset.
Connect (site access)
What it usually means: the site can see your address(es) and may propose transactions or signatures. Connecting alone does not move funds.
Still risky when: the site is a phishing clone. After connect, the next prompt may be a malicious approval or signature. Prefer connecting only to URLs from bookmarks you created from official sources.
Send / transfer (on-chain transaction)
What it means: you are authorizing a transaction that can move native coin or call a contract. Check network, to address, amount, and estimated fee. Address-poisoning scams rely on you copying a lookalike address from history—verify against your own address book.
Token approval / spending cap
What it means: you grant a spender permission to pull tokens later (see What is a token approval?). Confirm token, spender, and whether the allowance is unlimited. This is not the same as “I already sent the tokens.”
Sign message (off-chain signature)
What it often means: proving control of an address for login, allowlists, or “gasless” flows. Many signatures are harmless; some are not.
- Prefer human-readable messages. Opaque hex blobs are harder to audit.
- Never sign a message that embeds or requests your seed phrase.
- Be cautious with signatures that look like structured permissions (see permit below).
Permit / typed data (EIP-2612 and friends)
What it can mean: a signature that grants a token allowance without a separate on-chain approve transaction first—often marketed as “gasless approve.” Educators note that a permit-style signature can still authorize a spender. Treat it with the same seriousness as an on-chain approval: who is the spender, what amount, which token, which chain.
Red flags on any prompt
- Urgency or threats (“wallet compromised—sign now”).
- Site origin you did not intentionally visit from a trusted bookmark.
- Unlimited spending caps you did not ask for.
- Blind signing on a hardware wallet when the device cannot show clear details—Ledger and other vendors publish guidance on enabling clear-signing where available.
- Requests for seed words, private keys, or “sync phrases” inside any prompt or adjacent form.
Related free docs & literacy pack
- What is a token approval?
- Common crypto scams to recognize
- How to read a blockchain transaction
- Wallet prompt decoder mini-book (teaser) — overview only; no payment link on this page
Sources
- ethereum.org — Security and scam prevention
- MetaMask Support — Staying safe (vendor education; not an endorsement)
- Ledger Academy — Security topics (vendor education; clear-signing concepts)
- EIP-2612 — Permit extension for ERC-20
- CISA — Recognize and report phishing
Educational content only — not investment advice. This page explains wallet UI categories and abuse patterns; it does not recommend any wallet vendor, token, or trade.