aboutcrypto

Verify Wallet Ownership With a Signature

Published on

A public key proves control of a wallet only when a signature made by its matching private key verifies against it.

For an Ethereum externally owned account, the wallet keeps the private key and derives a public key. The familiar address is the last 20 bytes of the public key’s Keccak-256 hash. The address identifies the account; the private key produces its ECDSA signature.

What the verifier actually checks

The verifier hashes the exact bytes presented for signing, checks the signature against the public key, and compares the recovered address with the claimed address. Change one character, domain, or destination and the verification no longer covers the altered message. This proves control at signing time, not legal identity.

  1. The application creates a challenge containing its domain, wallet address, fresh nonce, and expiry.
  2. The wallet displays and signs it internally; the private key never leaves the wallet.
  3. The server verifies the signature and accepts only the matching address with an unused nonce.

Nonces and domains prevent a valid signature being copied and replayed elsewhere. Sign-In with Ethereum (EIP-4361) standardizes those fields; EIP-712 handles typed, structured data.

Choose the signature for the action

Use a plain message for login, EIP-712 for readable authorization with named fields, and a transaction signature when the network must change state. The first two normally cost no gas because they are verified off-chain. A transaction costs gas and authorizes calldata such as an allowance or token transfer.

In a Frax Finance or Uniswap Protocol flow, signing a login challenge is not the same as approving Frax Dollar or authorizing a swap.

A swap through Frax Swap is an on-chain transaction: the signature authorizes its calldata and token movement, and the network charges gas.

For smart-contract wallets, there may be no private key behind the account; the application must use EIP-1271 to ask the contract whether a signature is valid. The practical rule: verify what was signed, who verifies it, and whether it spends anything.