How do signature-based approvals like ERC-2612 permit and Permit2 work, and what are their risks?
What the interviewer wants to hear
- User signs an EIP-712 message off chain instead of sending approve
- Contract verifies signature, nonce and deadline, then sets allowance or transfers
- Saves a transaction and improves UX
- Phishing: signatures look harmless but can give away funds
- Use short deadlines, exact amounts, and handle front-run permit calls gracefully
Model answer
With ERC-2612, the token itself has a permit function. The user signs an EIP-712 message with owner, spender, value, nonce and deadline, and anyone can submit it; the token checks the signature and sets the allowance. A dApp can then call permit and transferFrom in one transaction, so the user skips a separate approve. Permit2 from Uniswap does the same for any ERC-20: the user approves Permit2 once, and later grants spending through signed, expiring permissions. The main risk is phishing, because signing feels free, but a malicious permit can drain tokens, so wallets must show clear details and users should check them. As a developer I use short deadlines and exact amounts, and I wrap the permit call in a try block, since someone can front-run it with the same signature and make my call revert even though the allowance is already set.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Blockchain Developer questions
- What is a reentrancy attack and how do you prevent it?
- What techniques do you use to reduce gas costs in Solidity contracts?
- How do you test a smart contract before deploying it to mainnet?
- How do upgradeable smart contracts work, and what are the trade-offs?
- What is a blockchain oracle and how do you use price data safely?
- How do you build a reliable dApp frontend that reads and writes contracts with viem and wagmi?
- How do chain reorganizations affect a dApp or backend service, and how do you handle them?
- How do you design admin control for a protocol so it can be maintained without making users trust a single person?
- Walk me through how you deploy a set of contracts to mainnet safely.