Signature Requests

Establish the right context: message signatures

A practical way to approach message signatures is to place it inside a real task and start with transaction signatures.

A useful review order is source, object, request, and result. The source establishes where the action came from, message signatures identifies the object, and transaction signatures clarifies the scope. After submission, keep a transaction hash or other public record so that changing status can be checked again without relying on one interface message.

Keep the security boundary explicit: the user controls the seed phrase and private keys, and imtoken will never ask for them. If a third party links message signatures to a request for recovery secrets or verification codes, stop. When transaction signatures is involved, also verify the address, network, amount or permission scope.

Understand how it works in practice: transaction signatures

How transaction signatures, typed data, and domain name relate in practice

transaction signatures is easy to misunderstand when context is missing. The account, typed data, and the intended action should agree before a familiar interface is treated as meaningful evidence.

Do not treat “already connected,” “used before,” or “looks familiar” as sufficient evidence. Review transaction signatures for the actual object, typed data for the transaction or permission boundary, and domain name for the resulting state. If one step remains unclear, declining is a valid outcome.

If a result differs from expectations, record transaction signatures, typed data, and other non-secret evidence, then reconstruct the sequence of actions. Never send recovery secrets to someone offering to “restore” or “verify” an account, and avoid untrusted remote-control software.

• Confirm the real object behind transaction signatures
• Check the network or permission scope for typed data
• Use domain name or another public record to verify the result
• Never share a seed phrase, private key or verification code

Review the action step by step: typed data

Within Signature Requests, typed data is not an isolated term; it affects domain name and the on-chain result a user eventually sees.

The same term can behave differently across networks or DApps, so typed data should always be interpreted in context. domain name provides a second verification angle, while request content helps confirm what actually happened afterward. Network-specific rules should be checked against trustworthy information for that network.

Verification continues after submission. Keep public evidence related to typed data and use domain name to review status when necessary. On-chain transactions generally cannot be reversed by a wallet provider alone, and third-party DApps or contracts can carry their own risks, so blind resubmission is a poor troubleshooting method.

Recognize common mistakes and risks: domain name

How domain name, request content, and message signatures relate in practice

When using Signature Requests, first identify whether the current object is an account, asset, network, transaction or permission. Then relate domain name to request content instead of reading either label alone.

If an interface mixes several layers of information, check domain name, request content, and message signatures separately. Names, icons, and familiar layouts are presentation details, not substitutes for the actual network, address, contract, or on-chain state. When the evidence conflicts, fewer new actions usually make troubleshooting easier.

The purpose of learning Signature Requests is to understand the action rather than mechanically complete it. Whenever domain name, request content, or the expected result cannot be explained, preserve the option to decline, exit, or verify again later.

• Confirm the real object behind domain name
• Check the network or permission scope for request content
• Use message signatures or another public record to verify the result
• Never share a seed phrase, private key or verification code

Build a repeatable verification habit: request content

When a request involves request content, slow the decision down enough to identify what it changes, which network it relies on, and whether message signatures can be independently verified.

For Signature Requests, a repeatable verification habit is more durable than memorizing where a button appears. Check request content, then message signatures, and finally transaction signatures. Interfaces can change and network conditions can move, while the reasoning behind those checks remains useful.

Over time, revisit request content and message signatures, remove connections or permissions that are no longer needed, and keep the device and browser environment trustworthy. Security is not an absolute promise; it is a process of reducing secret exposure, mistaken approvals, and avoidable uncertainty.