What are token approvals and why are they dangerous

02 September 2026

Token approvals are a core but often misunderstood feature of the ERC-20 standard on Ethereum. They were designed to let smart contracts move tokens on your behalf, enabling decentralized exchanges, lending protocols, and automated market makers. The process has two steps.

First, you call the approve function on a token contract. This grants a specific spender - usually another smart contract - permission to move a set number of your tokens. Second, that spender calls transferFrom to actually execute the transfer. Your tokens never leave your wallet in the first step. You are simply authorizing a future movement.

This two-step design matters because it separates permission from execution. But in practice, the system creates a dangerous asymmetry.

The convenience trap

Most user interfaces, including major decentralized exchanges like Uniswap, prompt you to set an approval before a trade. Many users approve an unlimited amount - often the maximum possible value the Ethereum Virtual Machine can handle. The reason is convenience. Nobody wants to approve every single trade individually, paying gas fees each time.

The problem is simple. An unlimited approval gives a contract the power to drain your entire balance of that token, at any time, in one transaction. You do not need to approve again. The contract already holds the key.

If that contract is malicious, or if it gets exploited, your tokens are gone. No warning. No second signature needed. An exploit in a lending protocol or a compromised front end can sweep tokens from every wallet that ever granted an unlimited approval.

Permit: the silent variant

A newer and even more dangerous vector is the permit function, part of the ERC-2612 standard. It allows token approvals to be granted via an off-chain signature. You never send a transaction. You just sign a message in your wallet.

The trick is that this signature can be submitted to the blockchain later by anyone who has it. A scam website can prompt you to sign what looks like a harmless message - to verify your wallet, to claim an airdrop, to log in. The message is actually a permit signature that grants unlimited approval to the scammer's contract.

You do not see a transaction in your wallet. You do not pay gas. You simply sign. And then, at the scammer's convenience, your tokens move.

This is called a "permit phishing" attack. It is increasingly common because users have learned to recognize malicious transactions but are less wary of off-chain signatures. The signature itself is free to create. The scammer only pays gas to execute the drain.

How to protect yourself

You cannot avoid approvals entirely if you use DeFi. Every interaction with a smart contract that moves your tokens requires one. But you can limit the damage.

Never grant unlimited approval. Use the "custom" or "exact" option in your wallet if it is available. Approve only the amount you need to spend right now, plus a small buffer for slippage. Some wallets now default to limited approvals. If yours does not, change the setting.

Be extremely suspicious of signing messages. A legitimate site will almost never ask you to sign a permit. If you see a "sign to verify" prompt, especially from an unfamiliar site, reject it. Use a hardware wallet that requires a physical button press to sign. Even that is not foolproof, but it adds a step that scammers must overcome.

Audit your existing approvals

You have probably approved dozens of contracts by now. Most of them sit unused. Every stale approval is a risk.

Two free tools can help you clean them up. Revoke.cash is a web-based tool that connects to your wallet and lists every token approval you have granted across multiple chains. It shows the spender address, the approved amount, and the token. You can revoke any approval with a single transaction. The tool does not store your data.

Etherscan has its own token approval checker. Go to your address page on Etherscan, click the "Token Approvals" tab, and you will see a similar list. The interface is less polished but still functional. Revoking an approval costs gas, but it is cheap compared to the alternative.

Check your approvals regularly. Every month is a good interval. Treat any unlimited approval to a contract you no longer use as an active threat. Revoke it.

The Ethereum blockchain records everything. That includes every approval you ever made. They do not expire. They do not self-revoke. They sit there forever, waiting for a vulnerability or a scammer to exploit them. You are the only one who can close the door.

Back to ethereum