Token approvals and wallet security

The essentials

An ERC-20 approval lets a spender contract transfer a specified allowance on your behalf. Some allowances are very large and remain after the first interaction. A deceptive approval can be as harmful as a direct transfer, even if the initial transaction sends little value.

How it works

Application risks include bugs, reentrancy, manipulated prices, administrative abuse and failed dependencies. An audit reduces some uncertainty without eliminating it. Review the particular contract and version, rather than treating an audit logo as a blanket guarantee. Revoking an allowance prevents future use of that allowance, not recovery of assets already taken.

What to watch

Ask which contract receives what right, over which asset, on which network and for how long. Addresses are pseudonymous rather than inherently anonymous. Public interactions can reveal relationships, while RPC services and interfaces can observe metadata or fail independently of the chain itself.

Understand the details

An ERC-20 approval generally lets a specified spender move tokens up to an allowance. It does not necessarily move tokens immediately. The spender can be a contract whose behavior deserves separate review. An unlimited allowance reduces repeated approvals but leaves a larger continuing permission. A signed permit may authorize similar behavior without an initial approval transaction by the token owner.

Boundaries and common mistakes

Disconnecting a website usually removes an interface connection, not an on-chain allowance. Revocation itself may require a transaction and fees. Checking the token symbol is insufficient because unrelated contracts can use the same symbol. Identify the chain, token contract, spender, amount and any expiry or nonce.

The mechanism at a glance

Continue learning

Look up a term in the glossary →