The js code uses polkadot api, util-crypto and extension-dap

    const { signature } = await signRaw({
        address: account.address,
        data: payload,
        type: 'bytes'
    // isValid is true
    const isValid = await signatureVerify(payload, signature, account.address);

The rust code crates the payload and passed it has hex_encoded into the js code. I make sure that hex encoding and decoding was all correct, but I couldn't understand why the signature is valid in js code, but verifying it in the rust code against the payload returns invalid.

    let is_valid1 = signature.verify(payload.as_slice(), &signer_address);
    // invalid
    let message = format!("rust signature is valid1: {}", is_valid1);
  • 1
    Is it fixed by this? Commented Sep 6, 2022 at 15:09
  • 1
    @OliverTale-Yazdi OMG! why is this so hack. Wrapping the payload with Bytes tag, I was indeed able to verify that the signature is thus valid, but now the payload is different, and submitting the derived extrinsic and signature into the substrate node still gets rejected. Is there a way to use polkadot signature with the the Wrapping <Bytes>?
    – ivanceras
    Commented Sep 6, 2022 at 16:46
  • 1
    Okay then I think we can close this as duplicate. I don't know if PolkadotJS can be used without Bytes, I don't hope so since that would be a security issue. Why can you not wrap the message in Bytes before verifying? Commented Sep 6, 2022 at 18:27
  • 1
    @OliverTale-Yazdi Wrapping the payload with <Bytes> to verify that the signature is fine in this case, since I have control on this part of the code. But submitting the actual signature as an extrinsic into the substrate node will be rejected with an Invalid Signature, since it has another verification step where I don't wish to change the code in that part.
    – ivanceras
    Commented Sep 7, 2022 at 15:27

1 Answer 1


To protect the user from signing arbitrary content that can not be displayed in the extension, signRaw wraps the binary payload between <Bytes></Bytes> tags. So the message signed by the extension is not the one you expect.

Not the answer you're looking for? Browse other questions tagged or ask your own question.