Token approvals: the permission that quietly drains wallets
Every DeFi app you touch asks for a token approval, and most of them ask for an unlimited one. Here is what that permission actually grants, how it gets abused, and the review routine that keeps it contained.
Reviewed by Mason Walker, Ethereum & Layer-2 · Last reviewed August 10, 2026
On this page
A token approval is standing permission for a smart contract to move a specific token out of your wallet, up to a limit you set. It is not a one-off consent for the swap in front of you: it persists after the transaction, after you close the tab, and after you forget the app ever existed. Revoking approvals you no longer use is the single cheapest security habit in crypto, and almost nobody does it.
What is a token approval?
Tokens on Ethereum and compatible chains follow a standard interface in which your balance is a number recorded inside the token's own contract, not inside your wallet. When you swap on a decentralised exchange, the exchange contract has to move that balance on your behalf. It cannot do so unless you first call the token's approve function and name it as an authorised spender.
The call takes two arguments: which contract may spend, and how much. Your wallet then shows a transaction that is easy to skim past, because nothing appears to leave your account. Nothing does — yet. What leaves is a permission, recorded on-chain, that stays valid until you change it.
- Spender: the contract address allowed to move your tokens. Usually a router, a vault, or a marketplace.
- Allowance: the ceiling. It might be the exact amount of the trade, or a number so large it is effectively unlimited.
- Scope: one approval covers one token for one spender on one chain. Approving USDC on a DEX says nothing about your ETH, or about the same DEX on another network.
- Duration: none. The allowance sits there until you or the spender reduces it.
Why is unlimited the default?
If an app requested an exact allowance every time, every swap would cost two transactions instead of one, and users would pay gas twice. Requesting a very large number once means every later interaction is a single click. That is a genuine convenience win, and it is why the pattern spread across the ecosystem.
The trade-off is that the permission outlives the reason for granting it. A wallet that has used a dozen protocols over a couple of years is typically carrying dozens of live, unlimited allowances to contracts the owner no longer thinks about — and whose code they never read.
How do approvals actually get exploited?
There are three broad routes, and only one of them requires you to make a mistake today.
| Route | What happens | What protects you |
|---|---|---|
| Protocol compromise | A contract you legitimately approved is exploited or upgraded maliciously; the attacker uses existing allowances to pull tokens. | Revoking allowances you are not actively using. |
| Malicious approval | A fake or copycat app asks for an approval that looks routine. The spender is the attacker's contract. | Reading the spender address, and only ever approving from bookmarked sites. |
| Signature phishing | You sign an off-chain message rather than a transaction. No gas, no obvious approval — but it authorises a transfer. | Treating any signature request as seriously as a transaction. |
The third route is the one that has grown fastest, because it does not look like anything. Modern token standards let you grant an allowance by signing a message off-chain, which a relayer then submits. The wallet pop-up shows structured data rather than an obvious spend, and there is no gas prompt to slow you down.
How do you review and revoke approvals?
Approval dashboards read the same public data your wallet does, and let you send the revoke transaction from the interface. The mainstream ones are revoke.cash and the token-approval checker built into most block explorers; several wallets now ship the feature natively. Whichever you use, connect it, switch to each chain where you hold value, and read the list.
- Sort by allowance size, then by how long ago you last used the protocol. Old and unlimited is the pile to clear first.
- Revoke by setting the allowance to zero — it is an ordinary transaction that costs gas on that chain.
- Repeat per network. An allowance on one chain is invisible to a dashboard pointed at another.
- Re-check after any incident involving a protocol you have used, without waiting for confirmation of the details.
- Verify the dashboard's own URL before connecting. Fake revoke tools exist precisely because worried users search for them in a hurry.
Two limits are worth being blunt about. Revoking is not a rollback: if tokens have already been moved, the transaction that moved them is final. And revoking does not touch off-chain signatures you have already given, which some dashboards surface separately and some do not.
What does a sustainable routine look like?
Perfection is not the goal; containment is. The aim is that a compromise of any single contract costs you a bounded amount rather than everything you own. If you are still finding your footing in decentralised finance, start with a wallet built for it — our best DeFi wallets ranking compares the mainstream options.
- Split wallets by purpose: a long-term wallet that never connects to applications, and a smaller one that does the interacting.
- Where an app offers a custom allowance, set it near the size of the trade. Paying a little extra gas is cheap insurance.
- Put a recurring reminder in the calendar — quarterly is enough for most people — to clear stale approvals.
- Sign from a hardware wallet for meaningful balances, and actually read what the device screen says the transaction does.
- Treat a signature request with the same suspicion as a transfer, especially when it arrives via a link someone sent you.
None of this makes you immune. It does mean that the ordinary background risk of using DeFi — that one of the many contracts you have touched turns out to be flawed — stops being an existential risk to your whole balance.
How do you tell a routine approval from a malicious one?
The prompt itself carries the evidence, if you read it rather than skim it. Three fields decide whether an approval is ordinary or a theft in progress, and all three are visible before you sign.
- The spender address. Compare it against the protocol's published contract address from its own documentation — not from the page requesting the approval.
- The token. A swap you initiated for one asset should not be requesting permission over a different one.
- The amount. If the interface offered no choice and the allowance is unlimited, that is a decision being made for you; decide whether you accept it.
- The simulation. Wallets that preview outcomes will say plainly if a balance is about to fall. A preview that contradicts what you expected is a stop signal, not a quirk.
Context matters as much as content. An approval request that appears the instant you connect a wallet, before you have asked for anything, is not part of a normal flow. Neither is an approval on a page you reached from a direct message, an advert or a search result rather than your own bookmark. The delivery side of these attacks — the ads, the lookalike domains, the urgency — is covered in our guide to avoiding crypto scams.
- 1. ERC-20 Token Standard (approve and allowance) — Ethereum Improvement Proposals
- 2. EIP-2612: permit — signed approvals — Ethereum Improvement Proposals
- 3. Token approval checker — Etherscan
- 4. Revoke.cash approval dashboard — Revoke.cash
Frequently asked
Does revoking a token approval get my money back?
No. Revoking sets the allowance to zero so the contract cannot move your tokens in future. Transfers that already happened are final and cannot be reversed by anyone.
Do token approvals expire on their own?
No. An allowance stays live until you reduce it or the spender uses it up. An approval granted years ago is as valid today as it was then.
Does it cost money to revoke an approval?
Yes — revoking is an on-chain transaction, so you pay that network's gas fee for each one. On a layer-2 network the cost is usually small; on a congested base layer it can add up, so batch the work when fees are low.
Should I approve an exact amount instead of unlimited?
Where the app allows it, yes. You pay gas more often, but a compromised contract can only ever take what you authorised rather than your whole balance of that token.
Are approvals a risk on every blockchain?
Any chain that uses the same token-permission model has the same exposure, and allowances are tracked per chain. Review each network where you hold value separately — clearing approvals on one does nothing for the others.
Kayla Peterson is a DeFi Research Analyst at Crypto Almanac Daily, where she specializes in decentralized finance, lending protocols, decentralized exchanges (DEXs), liquidity markets, yield strategies, and tokenomics. Her work focuses on analyzing the mechanics behind DeFi ecosystems, helping readers understand how lending platforms, automated market makers, liquidity incentives, and governance models influence the broader digital asset economy. Kayla regularly covers major protocols, emerging trends in on-chain finance, and the evolution of decentralized financial infrastructure through data-driven research and in-depth market analysis. Before joining Crypto Almanac Daily, she researched blockchain-based financial systems and digital asset markets, building expertise in protocol design, token economics, and decentralized capital markets. Her reporting combines technical accuracy with clear explanations, making complex DeFi concepts accessible to both experienced investors and newcomers to the industry. At Crypto Almanac Daily, Kayla contributes daily market coverage, protocol analyses, educational guides, and long-form research articles. Her goal is to provide readers with reliable, objective insights into the rapidly changing world of decentralized finance while highlighting the opportunities and risks shaping the next generation of financial innovation.
This guide is educational and general in nature. It is not financial, investment, legal or tax advice, and it does not account for your circumstances. Crypto assets are volatile and you can lose the money you put in. See our editorial policy and methodology.
