Should hardware wallets require a local intent preview?

I’m increasingly uncomfortable with “blind signing” becoming a normal step for smart-contract transactions. I might understand the amount and destination, yet still miss an approval, NFT transfer, delegated permission, or another lasting change to ownership hidden in the calldata.

A prompt like “Approve token spending: spender 0x…, amount uint256.max” can look like part of a routine swap while authorizing effectively unlimited withdrawals. Decoding standardized calls and verified metadata locally seems technically feasible, and keeping the security-critical display on the hardware is appealing. But arbitrary, composable, upgradeable contracts may not have a reliable one-line description of their full consequences. A polished summary could create false confidence, especially if it describes parameters but not downstream behavior.

Would you trust mandatory local intent previews, accepting incomplete coverage, or prefer a different safeguard for transactions that cannot be explained clearly?

The device can decode known formats, but “intent” is a much harder boundary than ABI parsing. A contract call can trigger other calls and state changes. I’d rather see a precise preview of what is known, plus an unmistakable “unverified effects” warning, than a confident but incomplete sentence.

The distinction between readable and complete matters here. EIP-712 and clear-signing formats can expose structured fields, but metadata support is conditional. That supports better disclosure, not a claim that the wallet has established the user’s entire intent.

Users will treat whatever appears on the screen as the truth, even if it says “partial.” That is not an argument against previews, but the uncertainty needs to be visually harder to ignore than the approve button.

I’d want the preview generated and verified locally, with the contract address, chain, spender, allowance, and permissions made prominent. The phone can suggest context, but it should not be the authority for what the device says will be signed.

A mandatory preview that says “unknown” is still more honest than a green checkmark. The danger is turning a useful warning system into another ritual people click through.

There’s also a usability cost. If every complex interaction becomes a wall of fields, people will either approve mechanically or move to a wallet that hides the friction. I’d prioritize good decoding for common standards and hard stops for unusually broad permissions.

Recovery and support would benefit from clearer records too. When something goes wrong, “I signed a swap” is not enough; knowing that an allowance or operator permission was granted changes the response. The preview should make those durable permissions unmistakable.

I’m not convinced local decoding is automatically safer. A stale or poorly verified descriptor could mislead users while giving the device an aura of authority. Independent simulation and revocation tools may cover different failure modes better.

This seems like a good case for graceful degradation: parse standard calls offline, show raw data when parsing fails, and refuse to compress unknown behavior into a friendly label. Local processing improves trust only if the inputs and mappings are verifiable too.

The product question is whether people understand the warning at the moment of signing. “Unlimited allowance” is meaningful; a paragraph about possible downstream effects probably isn’t. Strong defaults around allowance scope may protect more users than maximum detail.

For NFTs, “operator approved: true” should never be buried. That can cover the entire collection under that contract. I’d rather have a mandatory confirmation for collection-wide permissions than pretend every contract interaction can be summarized perfectly.

For institutional custody, I’d expect policy rules in addition to display: approved contract registries, allowance ceilings, and multiple human checks for permission changes. A screen is useful evidence, but governance cannot be reduced to a screen.

My preference is layered safeguards: local previews where standardized, explicit labels for approvals and transfers, simulation as a separate signal, and a deliberate path for unknown calls. No single preview can prove intent, but blind signing should be the exceptional case, not the default.