EIP-712 standardises structured signing. Its specification explicitly leaves replay protection to the application using the signature.

What the source establishes

EIP-712 defines hashing and signing for typed structured data, including a domain separator. It explicitly states that the standard does not include replay protection. Applications need to define what a signed message authorises and when it can be accepted. Ethereum Improvement Proposals — EIP-712 ↗

The standard describes domain fields that may identify a chain and verifying contract. Those fields help distinguish signing contexts when used correctly, but the presence of readable data alone does not establish one-time use or an expiry policy. Ethereum Improvement Proposals — EIP-712 ↗

What the distinction changes

The practical question is what the verifier does after receiving a valid signature. A message may be understandable to a person yet remain usable more than once if the application does not consume a nonce or otherwise restrict reuse. Signature validity and business-process validity are different checks.

For wallet interfaces, a clear display is valuable evidence of the proposed authorisation. It cannot substitute for checking the contract, domain and acceptance conditions. A polished signing window should not be treated as certification of the application’s behaviour.

Questions for the next review

Review the complete typed payload, its domain, any nonce, expiry and the verifier’s handling of prior use. Distinguish an off-chain signature request from an on-chain transaction, while recognising that the signature may enable later execution. Never infer harmlessness merely because signing itself charges no gas.