Permit signature attack

The attack relies on EIP-2612 (Permit Extension for EIP-20 Signed Approvals), which enables signature-based approvals instead of an on-chain approve() transaction. The EIP-712 signed structure contains owner, spender, value, nonce and deadline. The mechanism is silent: on a phishing site the victim signs a message, perceived as harmless because it is not a transaction confirmation and spends no gas, that authorizes the spender (the attacker's address) to move their tokens.

With that signature in hand, the attacker submits the Permit on-chain to set the allowance and then calls transferFrom, draining the tokens. There is no protocol exploit, no flash loan, and no on-chain approve from the victim. It is the evolution of traditional approval phishing: signing a message feels less consequential than confirming a transaction, which makes it harder for users to detect. A related variant is Uniswap's Permit2.