Permit2 Approval Scope Checker

WHAT IT DOES

Permit2 Approval Scope Checker reads pending Permit2 signature request data from your wallet (EIP-712 permit or permitBatch), decodes the token address, spender address, approval amount(s), deadline, and nonce. It checks your current balance of the token being approved and your existing Permit2 allowance for the spender via the Permit2 contract. The tool then explains what the Permit2 signature authorizes, what the spender can do with the signed permit, how much they can spend (including batch permits), whether the deadline is reasonable, and what risks to consider before signing.

HOW TO USE

When your wallet prompts you to sign a Permit2 request, copy the signature data from your wallet or the requesting dApp. Open the Permit2 Approval Scope Checker, connect your EVM wallet, and paste the EIP-712 JSON into the input area. Click "Analyze Permit2 signature" to decode the message and generate a scope assessment. Alternatively, click "Manual entry" to enter the token address, spender address, amount, deadline, and nonce directly. The tool will display the token details, spender, amount(s), nonce, deadline, your balance, current Permit2 allowance, and a risk level with a detailed explanation. Review the AI explanation to understand the risk, then verify the details in your wallet before signing.

TECHNICAL SECTION — PERMIT2 SCOPE ASSESSMENT

The tool parses the EIP-712 Permit2 signature data, extracting the domain, types, and message fields. It identifies the token address, spender address, amount(s), nonce, and deadline from the message. The tool retrieves the user's balance of the token via RPC balanceOf calls and the current Permit2 allowance for the spender via the Permit2 contract's allowance() function. The risk assessment considers: whether the permit has expired, whether the amount is zero, whether the amount exceeds the user's balance, whether the amount is effectively unlimited (far exceeding the balance), the current Permit2 allowance status, the nonce value, and the reasonableness of the deadline. The AI layer receives the decoded data and generates a plain-language risk explanation. This approach helps you understand the impact of a Permit2 signature before you sign.

WHAT IT CANNOT SEE

This tool cannot read the actual intent behind a Permit2 signature request. It cannot determine if the spender address is malicious without an external database. It cannot detect if the signature will be used maliciously after it is signed. It cannot read the user's private key or session data. It cannot verify if the token contract is legitimate. It cannot determine if the Permit2 contract itself has been compromised. The user must still verify the permit request details in their wallet before signing. The AI explanation is generated from on-chain data and does not constitute financial advice or a security guarantee.

PLEASE NOTE

EVM chains only. Explanations are AI-generated from data the app reads on-chain—always review what you are actually signing in your wallet before approving it. The wallet's own signature prompt remains the final and only protection against unwanted signatures. This tool is read-only; it never sends transactions or signs anything on your behalf.