How token approvals work
The ERC-20 standard has an approve function: you sign a transaction that sets how much of a token a contract may spend. The app then moves tokens up to that amount without asking again.[1]
The ERC-20 functions involved are approve(address _spender, uint256 _value), which sets the limit, allowance(address _owner, address _spender), which reads what is left, and transferFrom(address _from, address _to, uint256 _value), which the app calls to pull tokens. Each approve emits an Approval event, which is how revoke tools find your approvals.[1]
NFTs work differently. approve() covers one NFT by ID, while setApprovalForAll() lets an address move every NFT you hold in that collection. Revoking the second means calling it again with false.[2]
A single-NFT approval clears itself when that NFT is transferred. Collection-wide approvals from setApprovalForAll stay until you revoke them.[2]
Risks and scams
Wallet drainers trick you into approving a malicious contract, then empty that token. Approvals given to apps that are later hacked are also a risk.[2]
Approvals to legitimate apps carry risk too. revoke.cash points out that a hack of a trusted contract can let an attacker move tokens from every wallet that still has an open allowance to it.[2]
How to stay safe
Approve only the amount you need, read what your wallet shows before signing and revoke old approvals with a revoke tool. revoke.cash notes that browser extensions can warn you before you approve a contract.[2]
ethereum.org recommends setting spending limits instead of unlimited access. In the example below, approving exactly 100000000 base units instead of the maximum value leaves nothing to take once the swap completes.[4]
Example: an approval flow
Illustrative example: you want to swap 100 units of a token that uses 6 decimals. First you sign approve(router, 100000000). Then you sign the swap, and the router calls transferFrom to take the 100 tokens, leaving an allowance of zero.[1]
If the app asked for the maximum uint256 value instead, the router could keep pulling that token from your wallet later without a new prompt. revoke.cash notes that a contract with an approval can spend your tokens at any time.[2]
EIP-20 says interfaces should set an existing allowance to 0 before setting a new value for the same spender, to prevent a known attack on changing allowances.[1]
Permit signatures
ERC-2612 adds permit(), which sets an allowance from an off-chain signature instead of an approve transaction. The wallet shows a typed EIP-712 message rather than a transaction, and a relayer can submit it for you.[3]
A permit has a deadline and uses a nonce, so each signature works once. The standard allows the maximum value as a deadline, which means the permit never expires. Anyone holding the signature can submit it, so a permit signed for a drainer sets the same allowance as an on-chain approval.[3]
ERC-2612 notes that a signed permit can be front-run and that a relayer can hold it back instead of submitting it. The deadline is what limits how long a withheld permit stays usable, so short deadlines reduce the exposure.[3]
How to check it yourself
Search your address in an approval checker such as revoke.cash to see your active approvals. Revoking calls approve again with an amount of 0, which is an on-chain transaction and costs gas.[2]
Common mistakes
Claiming a surprise airdrop. ethereum.org lists fake airdrops that ask for an approval as a common way wallets get drained.[4]
Signing an NFT marketplace listing without reading the price. revoke.cash describes phishing that tricks users into signing listings for 0 value.[2]
Reporting too late. If an approval was used to drain a wallet, revoke the remaining approvals first, then file a report at ReportFraud.ftc.gov or IC3.gov, which the FTC lists for crypto fraud.[5]
The Bottom Line
An approval is a standing permission. Keep them small and clean up the ones you no longer use.
Educational content, not financial advice.