[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GYJFBFZKBC389WNPSC2W7W":3,"skill-same:01M6GYJFBFZKBC389WNPSC2W7W":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":31,"frontMatter":32,"refName":33,"commitSha":34,"skillDirectory":35,"forksCount":36,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":39,"ownerDescription":40,"updatedAt":41,"install":42,"resources":55},"01M6GYJFBFZKBC389WNPSC2W7W","erc2612-permit-deadline-review",null,"Use when reviewing or issuing an ERC-2612 permit signature. Sets a short deadline, caps the approved value, verifies spender and nonce, and checks the domain before signing.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-erc2612-permit-deadline-review\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-erc2612-permit-deadline-review\u002FSKILL.md",[],[20,21,22,23,24,25,26,27],"review","erc2612 permit deadline review","short","use","domain","signing","value","when","2026-11-10 10:12:30",false,"---\nname: erc2612-permit-deadline-review\ndescription: Use when reviewing or issuing an ERC-2612 permit signature. Sets a short deadline, caps the approved value, verifies spender and nonce, and checks the domain before signing.\n---\n\n# Review an ERC-2612 permit deadline\n\nA permit is an approval with no transaction and no gas, and it stays valid until its deadline expires. This skill bounds that window to minutes, caps the amount, and verifies the spender and nonce so a leaked or replayed permit cannot move the whole balance.\n\n## Procedure\n\n1. Read the token's current permit nonce for the owner; a replayed permit with the same nonce reverts, but a fresh one is dangerous:\n   `cast call $TOKEN \"nonces(address)(uint256)\" $OWNER --rpc-url $RPC`\n2. Verify the domain the permit is bound to:\n   `cast call $TOKEN \"DOMAIN_SEPARATOR()(bytes32)\" --rpc-url $RPC`\n   Confirm the token supports EIP-2612 by checking that `permit`, `nonces`, and `DOMAIN_SEPARATOR` all exist.\n3. Set the deadline tightly. For an interactive flow use `deadline = now + 1200` seconds (20 minutes); never `type(uint256).max`, which is a permit that never expires.\n4. Set `value` to the exact amount needed, not `MAX_UINT256`. A permit to `MAX` is an unlimited approval that costs the attacker no gas to obtain.\n5. Confirm the `spender` is the contract you intend (a router or vault) and not an arbitrary address.\n6. Confirm the `owner` in the permit is the address you are signing from and not one derived from a different path.\n7. Sign only after re-reading the spender and value in the wallet UI, and confirm the chain id in the domain.\n8. If you are the verifier, enforce a maximum acceptable deadline on-chain and revert anything longer.\n\n## Pitfalls\n\n- A permit with a far-future deadline is functionally an unlimited, unrevocable approval; revoking it requires either an on-chain `approve` reset or waiting out the deadline.\n- Permits are front-runnable: anyone who sees a pending permit can submit it first and consume the nonce. Set short deadlines and submit promptly.\n- A permit for one token, signed for the wrong `spender`, can be presented to any contract that calls `permit` on that token.\n- EIP-2612 support is not universal; tokens without it silently lack `permit`, and calling it reverts or, on some proxies, does nothing.\n- The `value` in a permit is the allowance amount, not a transfer amount; setting it to `MAX` is an approval, not a payment.\n\n- A permit signed over a chain with a forked twin is replayable there if the domain omits the chain id.\n- Reading `nonces` from a stale block can show an old value; read at `latest` right before signing.\n- A UI that hides the deadline is hiding the single field that governs how long the risk lasts.\n\n## Verification\n\n    cast call $TOKEN \"nonces(address)(uint256)\" $OWNER --rpc-url $RPC && cast call $TOKEN \"DOMAIN_SEPARATOR()(bytes32)\" --rpc-url $RPC\n    # expect a monotonically increasing nonce and a domain separator matching the token\n\nReport the permit nonce, the domain separator, the spender, and the chosen deadline in seconds, with the commands behind them.\n","# Review an ERC-2612 permit deadline\n\nA permit is an approval with no transaction and no gas, and it stays valid until its deadline expires. This skill bounds that window to minutes, caps the amount, and verifies the spender and nonce so a leaked or replayed permit cannot move the whole balance.\n\n## Procedure\n\n1. Read the token's current permit nonce for the owner; a replayed permit with the same nonce reverts, but a fresh one is dangerous:\n   `cast call $TOKEN \"nonces(address)(uint256)\" $OWNER --rpc-url $RPC`\n2. Verify the domain the permit is bound to:\n   `cast call $TOKEN \"DOMAIN_SEPARATOR()(bytes32)\" --rpc-url $RPC`\n   Confirm the token supports EIP-2612 by checking that `permit`, `nonces`, and `DOMAIN_SEPARATOR` all exist.\n3. Set the deadline tightly. For an interactive flow use `deadline = now + 1200` seconds (20 minutes); never `type(uint256).max`, which is a permit that never expires.\n4. Set `value` to the exact amount needed, not `MAX_UINT256`. A permit to `MAX` is an unlimited approval that costs the attacker no gas to obtain.\n5. Confirm the `spender` is the contract you intend (a router or vault) and not an arbitrary address.\n6. Confirm the `owner` in the permit is the address you are signing from and not one derived from a different path.\n7. Sign only after re-reading the spender and value in the wallet UI, and confirm the chain id in the domain.\n8. If you are the verifier, enforce a maximum acceptable deadline on-chain and revert anything longer.\n\n## Pitfalls\n\n- A permit with a far-future deadline is functionally an unlimited, unrevocable approval; revoking it requires either an on-chain `approve` reset or waiting out the deadline.\n- Permits are front-runnable: anyone who sees a pending permit can submit it first and consume the nonce. Set short deadlines and submit promptly.\n- A permit for one token, signed for the wrong `spender`, can be presented to any contract that calls `permit` on that token.\n- EIP-2612 support is not universal; tokens without it silently lack `permit`, and calling it reverts or, on some proxies, does nothing.\n- The `value` in a permit is the allowance amount, not a transfer amount; setting it to `MAX` is an approval, not a payment.\n\n- A permit signed over a chain with a forked twin is replayable there if the domain omits the chain id.\n- Reading `nonces` from a stale block can show an old value; read at `latest` right before signing.\n- A UI that hides the deadline is hiding the single field that governs how long the risk lasts.\n\n## Verification\n\n    cast call $TOKEN \"nonces(address)(uint256)\" $OWNER --rpc-url $RPC && cast call $TOKEN \"DOMAIN_SEPARATOR()(bytes32)\" --rpc-url $RPC\n    # expect a monotonically increasing nonce and a domain separator matching the token\n\nReport the permit nonce, the domain separator, the spender, and the chosen deadline in seconds, with the commands behind them.\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fpayments\u002F0xklen-erc2612-permit-deadline-review",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-14 02:27:51",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill erc2612-permit-deadline-review",{"tool":48,"command":49},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill erc2612-permit-deadline-review",{"tool":51,"command":52},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill erc2612-permit-deadline-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-erc2612-permit-deadline-review\u002FSKILL.md",true,[56,60,66],{"path":57,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":16},"LICENSE","许可证",1063,{"path":61,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":64,"sourceHtmlUrl":65},"SOURCE.md","REFERENCE","参考文档",356,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-erc2612-permit-deadline-review\u002FSOURCE.md",{"path":67,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":68,"sourceHtmlUrl":69},"TRUST.auto.yaml",2217,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-erc2612-permit-deadline-review\u002FTRUST.auto.yaml",[71,99,122,139,152,162],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":75,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":28},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":103,"licenseFileUrl":104,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":28},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[108,109,110,111,112,113,114,115,116,117,118,119,120,121],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":103,"licenseFileUrl":126,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":28},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[130,109,131,132,25,133,134,119,118,117,135,136,137,113,138,112,111],"mexc spot rest","REST","admin","Wallet","requests","actions","secure","data","orders",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":103,"licenseFileUrl":143,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":28},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[147,148,110,149,150,120,118,151,116,115,113,112],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":153,"name":154,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":155,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":28},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[159,160,161],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":166,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":28},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[170,171,172,173,174,175,176,23,177,178,179],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]