Signature Requests

Define the security boundary first

Verification focus

When working with Signature Requests, start by keeping message signatures, transaction signatures, and structured-data signatures in the same context. Help users distinguish signature types and review the target, contents, network and possible permission consequences before confirming. A familiar label or icon is not enough on its own; the active network, account, address, contract or transaction record should agree with the action you intend to take. For consequential actions, understanding exactly what is being requested matters more than moving quickly through a confirmation screen.

A practical Signature Requests workflow can follow a consistent sequence: confirm the source and destination, review structured-data signatures, then verify domain and origin in the correct network context, and finally inspect signature contents together with the possible on-chain consequence. Only after that review should you sign or submit. Keep non-secret evidence such as a transaction hash or contract address so the result can be checked later.

The central risk around Signature Requests is that “Just a signature” does not mean “no risk”; some signatures can later be used for approvals or contract actions. If an unexpected network switch, unfamiliar contract, excessive approval, changed address or urgency tactic appears, stop before confirming. Seed phrases, private keys and verification codes are never normal troubleshooting material; imtoken staff will not ask for them and they should not be submitted through websites, chats or remote-control tools.

Recognize the most common threat scenarios

Key observations during the workflow

For “Recognize the most common threat scenarios”, transaction signatures establishes the starting point, structured-data signatures helps explain whether the process is progressing as expected, and domain and origin is often the detail that can be cross-checked against wallet history or public on-chain data. If those facts conflict, stop and verify the source again. Transfers, signatures, approvals and cross-layer actions deserve a complete review even when the interface looks familiar.

It also helps to separate interface information from verifiable on-chain facts. domain and origin may describe the intent of an action and signature contents may provide useful status context, but important decisions should still be checked against how a signature may be used and the relevant network record. Wallet labels, token symbols, DApp copy and promotional language can all be imitated, so familiarity is not proof of authenticity.

When working with Signature Requests, start by keeping how a signature may be used, message signatures, and transaction signatures in the same context. Help users distinguish signature types and review the target, contents, network and possible permission consequences before confirming. A familiar label or icon is not enough on its own; the active network, account, address, contract or transaction record should agree with the action you intend to take. For consequential actions, understanding exactly what is being requested matters more than moving quickly through a confirmation screen.

Signals to review before confirming

Verification focus

A practical Signature Requests workflow can follow a consistent sequence: confirm the source and destination, review structured-data signatures, then verify domain and origin in the correct network context, and finally inspect signature contents together with the possible on-chain consequence. Only after that review should you sign or submit. Keep non-secret evidence such as a transaction hash or contract address so the result can be checked later.

The central risk around Signature Requests is that “Just a signature” does not mean “no risk”; some signatures can later be used for approvals or contract actions. If an unexpected network switch, unfamiliar contract, excessive approval, changed address or urgency tactic appears, stop before confirming. Seed phrases, private keys and verification codes are never normal troubleshooting material; imtoken staff will not ask for them and they should not be submitted through websites, chats or remote-control tools.

For “Signals to review before confirming”, message signatures establishes the starting point, transaction signatures helps explain whether the process is progressing as expected, and structured-data signatures is often the detail that can be cross-checked against wallet history or public on-chain data. If those facts conflict, stop and verify the source again. Transfers, signatures, approvals and cross-layer actions deserve a complete review even when the interface looks familiar.

• Review message signatures in the correct network context.
• Review transaction signatures in the correct network context.
• Review structured-data signatures in the correct network context.
• Review domain and origin in the correct network context.
• Review signature contents in the correct network context.

What to do after noticing something suspicious

Do not let urgency replace judgment

It also helps to separate interface information from verifiable on-chain facts. domain and origin may describe the intent of an action and signature contents may provide useful status context, but important decisions should still be checked against how a signature may be used and the relevant network record. Wallet labels, token symbols, DApp copy and promotional language can all be imitated, so familiarity is not proof of authenticity.

When working with Signature Requests, start by keeping how a signature may be used, message signatures, and transaction signatures in the same context. Help users distinguish signature types and review the target, contents, network and possible permission consequences before confirming. A familiar label or icon is not enough on its own; the active network, account, address, contract or transaction record should agree with the action you intend to take. For consequential actions, understanding exactly what is being requested matters more than moving quickly through a confirmation screen.

A practical Signature Requests workflow can follow a consistent sequence: confirm the source and destination, review transaction signatures, then verify structured-data signatures in the correct network context, and finally inspect domain and origin together with the possible on-chain consequence. Only after that review should you sign or submit. Keep non-secret evidence such as a transaction hash or contract address so the result can be checked later.

Long-term security habits and reviews

Verification focus

The central risk around Signature Requests is that “Just a signature” does not mean “no risk”; some signatures can later be used for approvals or contract actions. If an unexpected network switch, unfamiliar contract, excessive approval, changed address or urgency tactic appears, stop before confirming. Seed phrases, private keys and verification codes are never normal troubleshooting material; imtoken staff will not ask for them and they should not be submitted through websites, chats or remote-control tools.

For “Long-term security habits and reviews”, message signatures establishes the starting point, transaction signatures helps explain whether the process is progressing as expected, and structured-data signatures is often the detail that can be cross-checked against wallet history or public on-chain data. If those facts conflict, stop and verify the source again. Transfers, signatures, approvals and cross-layer actions deserve a complete review even when the interface looks familiar.

It also helps to separate interface information from verifiable on-chain facts. structured-data signatures may describe the intent of an action and domain and origin may provide useful status context, but important decisions should still be checked against signature contents and the relevant network record. Wallet labels, token symbols, DApp copy and promotional language can all be imitated, so familiarity is not proof of authenticity.