Token Approval
A token approval (the ERC-20 approve() function) is a transaction you sign that grants a smart contract permission to move up to a specified amount of your tokens on your behalf. Approvals are essential for DeFi — without them, protocols like Uniswap or Aave couldn't process your funds. But unlimited or forgotten approvals are one of the top causes of wallet drains.
How Token Approvals Work
When you interact with a DeFi protocol for the first time — swapping tokens on Uniswap, supplying liquidity to Aave, or minting an NFT — the protocol needs permission to move your ERC-20 tokens from your wallet. The ERC-20 standard doesn't allow contracts to pull tokens without explicit permission, so it provides the approve() function to grant it.
When you call approve(spender, amount), you're writing a record to the token's smart contract: "I allow this spender address to transfer up to X of my tokens." From that point on, the spender contract can call transferFrom() on your behalf to move those tokens — without requiring another signature from you.
Limited vs. Unlimited Approvals
An approval can be for a specific amount — for example, exactly the 1,000 USDC you're about to swap — or it can be unlimited. An unlimited approval sets the allowance to 2256 − 1 (the maximum value in Solidity), effectively allowing the approved contract to transfer every token you hold now or in the future.
Many DeFi protocols request unlimited approvals by default because it avoids the user needing to re-approve before every transaction. This is convenient but dangerous: if the protocol is later exploited or if you accidentally approved a malicious contract, the attacker has permanent access to your full token balance.
Why DeFi Needs Approvals
Token approvals solve a fundamental problem in blockchain design: smart contracts cannot initiate token transfers on their own. The user must explicitly authorise each contract. This is actually a security feature — it means contracts can only access what you allow them to access. The problem arises when users grant excessive permissions without understanding the risk, or when they forget about old approvals on protocols they no longer use.
How Attackers Exploit Approvals
Drainer contracts operate by tricking users into signing an approve() transaction for an unlimited amount to the attacker's address. The phishing site presents itself as a legitimate DeFi protocol, NFT mint, or airdrop claim. The moment you sign, the attacker's backend immediately calls transferFrom() and empties your token balance — often within seconds.
A more sophisticated variant uses the EIP-2612 Permit standard, which allows an off-chain signature (not an on-chain transaction) to serve as an approval. This bypasses most wallet warnings because it looks like a harmless message signing request rather than a transaction. Once the attacker has your Permit signature, they can submit it on-chain themselves and drain your wallet at any time.
How to Check for Malicious Approvals
If you suspect you've signed a malicious approval, act immediately. Go to revoke.cash, connect your wallet, and review all active approvals. The tool shows every contract that has permission to move your tokens, the amount approved, and when the approval was granted. Etherscan's Token Approvals tab and Debank.com provide the same information.
Look for approvals you don't recognise, approvals to unknown contracts, or unlimited approvals to protocols you no longer use. Any of these should be revoked immediately.
How to Revoke Token Approvals
Revoking an approval is a blockchain transaction that sets the allowance back to zero. On revoke.cash, click "Revoke" next to any approval and confirm the transaction in your wallet. Each revocation costs a small gas fee. You can revoke approvals on Ethereum, BNB Chain, Polygon, Arbitrum, and other EVM chains from the same interface.
Best Practices
Follow these principles to minimise approval risk:
- Approve exact amounts rather than unlimited when protocols offer the choice.
- Revoke approvals after completing a transaction if you don't plan to use the protocol regularly.
- Use Rabby Wallet instead of MetaMask — Rabby displays a human-readable breakdown of what each transaction approves before you sign.
- Run a monthly audit of your approvals using revoke.cash, especially before moving large sums.
- Never sign an approval on a site you reached via an unexpected link, airdrop claim, or Telegram message.
Frequently Asked Questions
How do I check what approvals I've given?
Use revoke.cash, Etherscan's Token Approvals tool, or Debank.com. Connect your wallet and all active approvals for that address are shown. You can revoke any of them from the same interface.
Can a token approval drain my wallet?
Yes. If you sign an approval for an unlimited amount to a malicious or compromised contract, the attacker can call transferFrom() and empty your entire token balance at any time — often within minutes of you signing.
What is an unlimited token approval?
An unlimited approval sets the allowance to the maximum possible value (2^256 - 1), meaning the approved contract can transfer all of your tokens indefinitely. Many DeFi protocols request unlimited approvals for convenience, but they should be revoked after use.
How do I revoke a token approval?
Go to revoke.cash, connect your wallet, and click Revoke next to any approval you want to remove. Each revocation is a blockchain transaction and costs a small gas fee. It immediately removes the contract's permission to move your tokens.
Are token approvals the same on all blockchains?
The ERC-20 approve standard is used on Ethereum, BNB Chain, Polygon, Arbitrum, and most EVM chains. Tron (TRC-20) has an equivalent mechanism. Bitcoin does not use token approvals as it lacks smart contract functionality.