Check digest construction, account policy and replay rules together.
LET’S PICTURE IT
Validating a permission means checking its author, document, jurisdiction and remaining use.
SEE IT FOR YOURSELF
From a public address to a verified signatureStep 1 / 4
An address is public receiving information. It is not the private key that authorizes actions.
An address is public receiving information. It is not the private key that authorizes actions.The local signing system uses secret authorization material. It produces a signature; the private key is not sent along with it.A verifier checks the signed request under the account’s rules. A valid signature does not by itself prove that the action is safe.Balances belong to network state. A wallet is an interface and signing system, not a box containing coins.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Challenge one: match the digest
Compare raw Keccak, personal-message hashing and EIP-712 hashing for a stated message. Explain why a signer and verifier must agree on the exact convention.
Challenge two: check the account kind
For a contract account, explain why one recovered EOA is not a complete substitute for the account’s validation policy. Include the expected ERC-1271 result.
Challenge three: reject reuse
A message has a deadline but no consumed nonce. Explain how repeated acceptance inside the validity window can remain possible.
Write an acceptance checklist in prose
State the intended signer, digest schema, domain, action, nonce and expiry checks. A decoded signature is only one ingredient in that complete authorization decision.