I currently write a signer which aims to signMessage from the front end and returns its signature.

On EVM based, It contains \x19Ethereum Signed Message:\n prefix to invalidate the signing of malicious transaction data.

But my question is, how can I trust that the incoming message is not arbitrary data (eg. encoded transaction) while signing the message?

Thank you in advance


2 Answers 2


@t-nelson proposes an off-chain message signing proposal that contains a domain specifier (b"\xffsolana offchain") for a message to prevent social attacks by which the signer is tricked into signing a transaction.



Unfortunately, the full answer is you can't with a 100% success rate, which is why scams are so prevalent in crypto at the time of this writing. There are, however, steps you can take to increase the safety of your users, though:

  • Most crypto apps today are accessed over the web. Therefore, a lot of the same rules as in web2 apply regarding checking for SSL certificates etc.
  • Transactions have a set format and data that you're expecting to be signed generally does too. Use this to your advantage, by enforcing that data that needs to be signed has a specific format and trying to parse malicious data (e.g. transactions) out of the provided data before signing it.
  • I assume you'll likely want to sign transactions with your system too. A few tools and a lot of research for transactions simulation are currently being worked on, where you locally simulate transactions and present the predicted results of the said simulation to your user in a human-readable format to ensure they know what they are signing.
  • Allow users to submit and collect malicious sources of data, for which you can issue a warning/block altogether to minimize the number of your users who fall for a known scam/attack.

Like I said at the start, no foolproof method exists at this time, but these heuristics should provide a good starting point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.