SignScope

FICTIONAL EXAMPLE · GENERATED FROM OPEN-SOURCE ENGINE · $0

What would a
Permit2 scope report actually show?

This is a fictional, precomputed sample, not a paid client's report or a security audit. It uses a deliberately excessive unsigned Permit2 allowance to demonstrate the fields, warning categories, limitations and recommended next checks. You can read it without a wallet, account or payment.

Try the free browser-local analyzer ↗ View reproducible example JSON ↓
Not safe-to-sign certification

2 static scope warnings shown · no wallet connected · no chain or code review · no spending · no user data submitted.

01 / REQUEST IDENTITY

What is declared?

Struct
PermitSingle (EIP-712)
Network in message
Base, chainId 8453
Domain name
Permit2
Verifying contract
0x000000000022D473030F116dDEE9F6B43aC78BA3
Token address field
0x833589fCD6eDb6E08f4C7C32D4f71b54bdA02913 (the commonly published Circle USDC Base address; not independently checked onchain by this page)
Declared spender
0x2222222222222222222222222222222222222222 — invented for the sample
Owner
Unknown: an unsigned PermitSingle JSON alone does not recover a signature's actual wallet owner.

02 / FINANCIAL SCOPE

How much authority?

Declared allowanceMAX UINT160Effectively unlimited if the contract accepts it
Raw amount
1461501637330902918203684832716283019655932542975
Nonce
4
Permit signature deadline
1799999999 Unix seconds — deadline for presenting the signed permit, not the resulting allowance.
Allowance expiration
1893456000 Unix seconds — approximately January 2030 (more than three years after the pinned sample date).
Actual onchain allowance
Unknown; no RPC, transaction or wallet check was made.

03 / MACHINE-DETECTED WARNING SIGNALS

Two things to question.

01

MAXIMUM_ALLOWANCE

The signature requests the maximum permitted integer. Even if the application currently expects a small transfer, this declaration could authorize a much broader token allowance if used as intended. A developer should prefer an exact, bounded amount wherever possible.

02

LONG_LIVED

The allowance expiration is years away. A short signature submission deadline does not by itself shorten an allowance that has already been successfully set. Consider a narrower expiry and an explicit revoke/monitor policy.

These warnings come from the local parser, not a claimed formal audit. The example is deliberately concerning. No result on this page means a real wallet or transaction is legitimate or safe.

04 / UNVERIFIED ASSUMPTIONS AND NEXT CHECKS

What a real review would still require.

Verify domain and chain independently.

Check the contract address against the protocol's own published docs. Treat JSON supplied by a website as untrusted; inspect the actual wallet confirmation and the typed fields.

Identify the true spender.

Check which contract would actually call Permit2 to spend tokens. A fictional address is not a reputable deployer or proof of intended authorization.

Confirm precise amount and duration.

Request the smallest useful spending amount, and distinguish the permit's signature deadline from the resulting allowance's expiration.

Check actual execution separately.

A static report cannot authenticate balances, nonce use, smart-contract code, token decimals, existing onchain approvals, custom wallet policies, or transaction outcome.

OPTIONAL PROFESSIONAL-SCOPE SERVICE · 15 USDC LISTING

Have one legitimate unsigned approval you need explained?

The separate buyer-initiated service proposes a 1–2 page AI-assisted technical interpretation of one public/nonsecret unsigned EIP-712 or Permit2 request. The actual work, acceptance and delivery are only after a genuine third-party marketplace-funded order and a mutually acceptable scope. It does **not** include private data, wallet signing, recovering stolen assets, contract audit or a guaranteed safety verdict.

The marketplace listing is currently an offer only. No independent customer purchase, approval from an outside buyer, or new USDC receipt is asserted.

View original 15 USDC fixed listing ↗ Send nonsecret product feedback ↗

OPEN TECHNICAL REPRODUCTION

Audit the illustration, not a customer's data.

The exact synthetic input and the corresponding local engine output are both public. The fixed analysis time is 2026-10-20 12:30 UTC so that deadline calculations are reproducible. They are not a paid deliverable, signed message, onchain receipt or assessment of a real protocol.

Static JSON example ↗ Deterministic generator ↗ Local scope analyzer ↗