Token approvals: the permission you forgot you gave

Before a DEX can swap your USDC, you sign an approval: a standing permission for that contract to move that token from your wallet. The part nobody mentions is that approvals do not expire. Every allowance you have ever granted, to protocols you used once in a past cycle, is still live right now, and each one is a door that opens if the contract behind it ever turns hostile or gets exploited.

What an approval actually is

Token standards separate holding from spending. Your wallet holds the balance; an approval tells the token contract that a specific smart contract may transfer up to some amount of it on your behalf. The swap you signed two clicks later used that permission. The permission itself stayed.

Why "unlimited" became the default

Approving costs gas, so apps learned to ask once for an unlimited allowance instead of asking per trade. Cheaper and smoother, and it means the protocol you tried once in 2024 may still be authorized to move every token of that type you will ever hold. Convenience made the decision; you inherited the risk.

How approvals get abused

• Protocol exploits: an attacker who compromises a contract inherits every allowance ever granted to it, and drains approved tokens from thousands of wallets at once.
• Malicious dApps: a fake mint or airdrop site asks for an approval instead of a transfer. Sign it, and the drain happens a block later.
• Rug pulls with extra steps: some scam tokens ship transfer logic that abuses the approvals you grant while trading them.

The audit takes ten minutes

Tools like Revoke.cash and the token-approval pages of block explorers list every live allowance for your address, per chain. Revoking costs a small gas fee per approval. Do the obvious triage: anything unlimited granted to a protocol you no longer use goes first, anything you cannot even recognize goes immediately.

The habits that keep it clean

• Review approvals quarterly, per chain, the same way you audit exchange API keys.
• Prefer exact-amount approvals when the interface offers them; pay the extra gas as insurance.
• Keep a separate hot wallet for minting and experiments, so its approvals never touch your main holdings.
• Treat any unexpected approval request as an attack until proven otherwise. Transfers move one amount; approvals move everything, forever.

Terms in this article