Awarded once after a correct answer.
Separate approval, transfer and revocation
Useful first : Hot, warm and cold wallets · Ethereum accounts and transactions
Read the mechanics · Step 2 / 6
An ERC-20 approval lets a designated spender address transfer tokens up to a specified allowance on your behalf.
The essentials
An ERC-20 approval lets a designated spender address transfer tokens up to a specified allowance on your behalf. Some allowances are very large and remain after the first interaction. A deceptive approval can be as harmful as a direct transfer, even if the initial transaction sends little value.
How it works
Application risks include bugs, reentrancy, manipulated prices, administrative abuse and failed dependencies. An audit reduces some uncertainty without eliminating it. Review the particular contract and version, rather than treating an audit logo as a blanket guarantee. Revoking an allowance prevents future use of that allowance, not recovery of assets already taken.
What to watch
Ask which contract receives what right, over which asset, on which network and for how long. Addresses are pseudonymous rather than inherently anonymous. Public interactions can reveal relationships, while RPC services and interfaces can observe metadata or fail independently of the chain itself.
Understand the details
An ERC-20 approval generally lets a specified spender move tokens up to an allowance. It does not necessarily move tokens immediately. The spender can be a contract whose behavior deserves separate review. An unlimited allowance reduces repeated approvals but leaves a larger continuing permission. A signed permit may authorize similar behavior without an initial approval transaction by the token owner.
Boundaries and common mistakes
Disconnecting a website usually removes an interface connection, not an on-chain allowance. Revocation itself may require a transaction and fees. Checking the token symbol is insufficient because unrelated contracts can use the same symbol. Identify the chain, token contract, spender, amount and any expiry or nonce.
The mechanism at a glance
- 01Approve spender
- 02Allowance stored
- 03Spender uses permission
- 04Revoke remaining allowance
Read these as connected concepts, not necessarily consecutive steps.
Read the explanation
An ERC-20 approval generally lets a specified spender move tokens up to an allowance. It does not necessarily move tokens immediately. The spender can be a contract whose behavior deserves separate review. An unlimited allowance reduces repeated approvals but leaves a larger continuing permission. A signed permit may authorize similar behavior without an initial approval transaction by the token owner.
Put the mechanism into context
A user grants a spender 1,000 units, spends 100 through it and later disconnects the site. Assume the token decreases allowance normally. Record the remaining permission separately from the wallet’s balance and connection status.
Apply it in the workshop →What this mechanism does not guarantee
Disconnecting a website usually removes an interface connection, not an on-chain allowance. Revocation itself may require a transaction and fees. Checking the token symbol is insufficient because unrelated contracts can use the same symbol. Identify the chain, token contract, spender, amount and any expiry or nonce.
The distinction that changes the analysis
A wallet can have 30 tokens while granting a contract permission to spend up to 100. Approval is a ceiling on permitted spending, not a token transfer. Later deposits may increase what that still-authorised contract can take, within the applicable allowance.
Explain it yourself
Revisit the case above. Name what is established, what remains to be checked and the evidence needed to conclude. A strong answer addresses both sides of the diagram.
Apply the lesson to a case
A user grants a spender 1,000 units, spends 100 through it and later disconnects the site. Assume the token decreases allowance normally. Record the remaining permission separately from the wallet’s balance and connection status.
An allowance of 900 remains in this example. Disconnecting did not revoke it. An appropriate on-chain allowance update can remove it, subject to the token’s actual behavior. Verify the resulting state after inclusion; a wallet confirmation prompt is not evidence that revocation completed.
What a wallet signature authorises
Inspect
Check network, recipient, asset and permissions before signing.
Prepare a correction note
Describe the passage and the proposed correction. This creates a local note for you to share; it sends nothing. Do not include personal or confidential information.