Permit Signature Blocker for Untrusted Sites

WHAT IT DOES

The Permit Signature Blocker for Untrusted Sites monitors any dApp page for EIP‑2612 permit signature requests—a signing pattern that allows a spender to transfer your tokens without a separate approval transaction. It intercepts these requests via window.ethereum (using eth_signTypedData_v4), detects the domain name, the token contract address, the spender address, and the requested allowance amount, then checks them against your trust lists. If the site is on your trusted list, the signature is allowed silently. If the site is on your blocked list, the signature is blocked and the user is shown a warning. If the site is unknown, the tool displays a prominent warning and prompts you to Allow Once, Trust Site, or Block Site. This protects you from a growing class of phishing attacks where users are tricked into signing permit messages that grant unlimited token spending rights to malicious contracts—all without a visible approval transaction on the blockchain.

WHERE IT RUNS

It runs as a draggable overlay panel inside the BotGentz extension on any website that requests permit signatures via the Ethereum provider. This includes Uniswap, OpenSea, 1inch, and many other dApps that use EIP‑2612 permits, as well as potentially malicious sites trying to exploit the pattern.

HOW TO USE

1. Install the free BotGentz extension and ensure you have an EVM‑compatible wallet extension installed.

2. Navigate to any dApp where a permit signature might be requested.

3. Click the BotGentz icon and select "Permit Signature Blocker for Untrusted Sites" from the tools menu.

4. Click "Start Watching" to begin monitoring.

5. When a permit signature is detected, the tool displays a warning or block based on your site trust settings.

6. Choose an action: Allow Once, Trust Site (adds to trusted list), Block Site (adds to blocked list), or Dismiss.

7. Manage your trust lists directly in the panel settings.

8. Drag the panel to reposition it, resize it, collapse it, or press Escape to close.

THE ACTUAL MECHANISM — provider‑level interception with typed‑data decoding

This tool works by intercepting Ethereum provider calls at the API level. It wraps the window.ethereum.request method, specifically targeting eth_signTypedData_v4 and eth_signTypedData calls—the standard signature methods used for EIP‑2612 permits. When such a call is detected, the tool parses the typed data payload (a JSON‑structured object containing domain, message, and type definitions) to extract the permit parameters: the token (from the verifyingContract in domain or the owner/address in message), the spender, the requested value/allowance, and the deadline. It also captures the site domain from the page context. The tool then evaluates the site against the user‑defined trusted and blocked lists (stored via GM_setValue), and applies the configured policy: if the site is trusted, the call proceeds normally; if blocked, the tool throws an error to the caller, effectively blocking the signature request; if unknown, the tool shows a warning and pauses the request until the user explicitly allows or blocks it. This interception happens entirely in the page context—no blockchain queries are required, and the tool never signs or transmits anything itself.

THE PANEL

The panel is fully draggable by its title bar and snaps to the nearest edge of the viewport when released. You can resize it horizontally by dragging the left or right border; the height expands to fit content up to a maximum, with scrolling inside the warnings list. A collapse button minimizes the panel to a small floating chip showing "⚙️ Permit Blocker" — click it to expand back. Press Escape at any time to close the panel entirely. The panel remembers its last position, size, and expansion state per domain via localStorage.

PLEASE NOTE

- This tool requires the free BotGentz extension and a real EVM wallet extension (e.g., MetaMask) already installed in your browser.

- This tool works only on EVM‑compatible chains.

- The tool cannot detect permit requests that are made through custom signing methods not using the standard window.ethereum.request('personal_sign') or eth_signTypedData_v4 flow. It cannot detect permit requests that are initiated outside the page context (e.g., from a malicious browser extension). It cannot automatically block a permit signature without user confirmation. It cannot verify whether a spender is malicious with certainty.

- No private keys, seed phrases, or sensitive data are ever read, stored, or transmitted. The tool intercepts signature requests but does not sign or transmit anything on its own. Only anonymized usage metrics (panel open/close, permit detections) are collected; you can disable this in the extension settings at any time.