ERC-1271 lets a smart contract say whether a signature is valid on its behalf. Applications call isValidSignature(hash, signature) on the contract and accept the signature if it returns the magic value 0x1626ba7e. Because contracts have no private key, this is the only standard way for a multisig, smart wallet or DAO to sign in to an application, sign an order or approve terms.
Key takeaways
- One function:
isValidSignature(bytes32 hash, bytes signature) → bytes4. - The contract defines its own rules — m-of-n owners, passkeys, session keys, policy engines.
- Essential for institutional investors, who usually operate through multisigs or custodial smart accounts.
- dApps should use a signature checker that supports both EOAs (
ecrecover) and ERC-1271 contracts.
How it works
function isValidSignature(bytes32 hash, bytes memory signature)
external view returns (bytes4 magicValue);
A Safe-style multisig, for example, returns the magic value if enough owners have signed the hash. A smart account under ERC-4337 may validate a passkey signature. Applications must check the return value rather than assuming success.
Why tokenization platforms need it
- Institutional onboarding: funds, treasuries and family offices hold assets in multisigs. Sign-in, subscription agreements and order signing must work for them.
- Off-chain orders and RFQs: marketplaces using signed orders must validate contract signers.
- Permits: tokens should accept ERC-1271 signatures in permit-style approvals for contract wallets.
- Token bound accounts: ERC-6551 accounts sign via ERC-1271.
Pitfalls
- Replay across accounts: if several smart accounts share owners, a signature for one may validate for another. Wrap hashes with the account address and chain ID (EIP-712 domains).
- Counterfactual accounts: undeployed smart accounts cannot answer
isValidSignature; ERC-6492 defines a wrapper for that case. - Gas and state: validation can depend on mutable state (owners changed), so signatures may become invalid later — design flows accordingly.
Verifying both EOAs and contract wallets
// Illustrative signature check used by an order book or subscription form.
import {SignatureChecker} from "@openzeppelin/contracts/utils/cryptography/SignatureChecker.sol";
function _verify(address signer, bytes32 digest, bytes memory sig) internal view returns (bool) {
// Uses ecrecover for EOAs and calls isValidSignature for contracts (ERC-1271)
return SignatureChecker.isValidSignatureNow(signer, digest, sig);
}
Using a combined checker like this means institutional multisigs and retail EOAs follow the same code path.
Institutional onboarding example
A family office invests through a 3-of-5 multisig:
- The platform presents subscription terms as an EIP-712 message.
- Three signers approve the message inside their multisig interface.
- The platform calls
isValidSignatureon the multisig to confirm acceptance. - The multisig address — registered as the office’s verified wallet — receives tokens.
Without ERC-1271, the office would need a separate hot wallet, undermining its own controls.
Security checklist
- Include the verifying contract and chain ID in the signed domain (EIP-712).
- Bind signatures to the specific account to prevent cross-account replay.
- Handle undeployed smart accounts using ERC-6492 wrapped signatures.
- Re-validate at execution time; signer sets can change.
Frequently asked questions
Yes, depending on the wallet; many multisigs support off-chain message signing that isValidSignature later verifies.
EOA users don’t, but institutional and smart-wallet users do. Supporting both is best practice.
0x1626ba7e is the function selector of isValidSignature; returning it means “valid”.
Yes. Smart accounts rely on ERC-1271 to sign messages for dApps.
Yes — sign-in flows should verify signatures through ERC-1271 for contract wallets.
It cannot produce verifiable off-chain signatures; it must interact through on-chain transactions instead.
NUVZ is the RWA and Web3 engineering brand of ESS ENN Associates (est. 1993). Our team has designed and shipped tokenization platforms for real estate, education loans, solar PPAs, energy, carbon credits, bank deposits and trade documents. About us · Case studies
This article is for general information only and is not legal, tax or investment advice. Token standards evolve — always confirm the current status of an ERC at eips.ethereum.org and take advice from qualified counsel in each jurisdiction before issuing tokens.
