CASE 01 / INSPECT THE PERMISSION
What did you just sign?
Inspect four wallet requests, predict the authority they create, and test what happens after disconnecting, revoking or waiting.
Follow the case.
- Inspect the scope
Identify the website or spender, token, amount, network, and any deadline. A friendly button label is not the permission itself.
- Predict and decide
Classify authentication, a direct payment, a limited allowance or unlimited permission. Sign or reject the fictional request.
- Test later access
Disconnect the website, confirm a revocation, or leave the allowance alone. For a permit, compare submission before and after its deadline.
- Read the receipt
See what moved immediately, what a spender could take later, and how much remains. Replay the same request with a different control.
The scenario controls load with JavaScript. The explanation, checklist and model boundaries remain available below.
TAKE IT WITH YOU
The question to keep asking.
A signature can authenticate, pay, or authorize later spending. Match the exact authority to your intended action; check the resulting permission after the transaction confirms.
YOUR PRACTICAL CHECKLIST
- Identify the request type from its contents.
- Check the intended network, token and named spender or recipient.
- Compare the spending limit with the intended action.
- Distinguish a signature submission deadline from an allowance expiry.
- Treat website disconnection and confirmed allowance revocation as separate actions.
Model boundaries & mechanism sources
- All websites, accounts and DEMO tokens are fictional. No wallet API, private key, real signature or transaction is created.
- The wallet begins with 1,000 DEMO. One later transfer attempts to take 600; a request exceeding allowance fails in full. Unlimited permission is limited by the current balance, with future deposits excluded.
- The login is a correctly scoped sign-in message; the payment is a plain ERC-20 transfer. This does not classify arbitrary messages or batched transactions as safe.
- The permit follows ERC-2612: a two-hour deadline limits submission, not the lifetime of an allowance already established. Other permit standards can differ.
- A selected revocation is confirmed after any permit submission and before the spend attempt. Pending-signature cancellation, gas costs, transaction races and compromised keys are outside the model.
FOLLOW THE CONNECTIONS