Permit2
Permit2 is Uniswap's shared token-approval contract, and in phishing it is abused to obtain one signature that lets the attacker move several tokens the victim has already approved to Permit2.
How it works
Many users approve Permit2 once so that dApps can then request signature-based transfers. A drainer asks for a Permit2 batch signature (PermitBatch or PermitTransferFrom) that names the attacker as spender.
Because the on-chain approval to Permit2 already exists, a single off-chain signature is enough to empty every token covered by it.
How to protect yourself
- In a Permit2 request, read the spender and the token list; a batch covering many tokens on an unfamiliar site is a strong warning sign.
- Remove the Permit2 approval for tokens you do not trade actively.