You want to swap 100 USDC for ETH on a DEX. Your wallet prompts: “Approve USDC.” You click confirm, pay a small gas fee, and proceed with the swap.
What you probably didn’t notice: the approval amount wasn’t 100 USDC. It was unlimited — the maximum possible value the uint256 data type can hold, approximately 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457.58.
This is called an infinite approval (or unlimited approval), and it’s the default behavior of most DeFi interfaces. The DEX can now spend as much of your USDC as it wants — not just the 100 you intended to swap.
If that DEX’s contract is ever compromised, exploited, or turns malicious, every USDC token in your wallet is gone.
BLUF: An infinite approval grants a smart contract permission to spend an unlimited amount of your tokens — forever, until you manually revoke it. Most DeFi sites request infinite approvals by default to save you gas on future swaps. Every active infinite approval is a liability. Defense: (1) audit your approvals on revoke.cash, (2) approve exact amounts when possible, (3) revoke approvals you no longer use, (4) use wallets that default to exact-amount approvals.
What Is a Token Approval?
In the ERC-20 token standard, you can’t just “send” tokens to a smart contract for it to use. You must first approve the contract to spend tokens on your behalf. This is a two-step process:
Step 1: Approve
You call the token contract’s approve() function, specifying:
- Spender: the contract address allowed to spend your tokens
- Amount: how much they can spend
This is an on-chain transaction — you pay gas.
Step 2: TransferFrom
When you swap, the DEX calls transferFrom() to move your tokens into its contract. It can only transfer up to the approved amount.
The approval persists across transactions. If you approved 1000 USDC for Uniswap, the Uniswap router can spend up to 1000 USDC from your wallet — in one swap, or across many swaps, until the allowance is used up or you revoke it.
Why DeFi Sites Default to Infinite Approvals
Most DEX interfaces set the approval amount to type(uint256).max (the infinite value) instead of the exact swap amount. Here’s why:
| Reason | Explanation |
|---|---|
| Save gas | Each approval is an on-chain transaction (~$3-15). Infinite approval = one-time cost vs. paying for every swap |
| Better UX | User doesn’t have to approve before every single swap |
| Composability | Some protocols need flexibility to move variable amounts (liquidations, auto-compounding) |
From the protocol’s perspective, infinite approvals make sense. From a security perspective, they’re a systemic vulnerability.
The Math of Infinite Approval Risk
Consider this scenario:
- You approve Uniswap Router V3 for unlimited USDC
- You approve Uniswap Router V3 for unlimited DAI
- You approve Uniswap Router V3 for unlimited WBTC
- You approve Aave for unlimited USDC
- You approve 1inch for unlimited USDC, DAI, WBTC, LINK
Each approval is a potential drain point. If any one of these contracts is exploited, the attacker can drain all tokens you approved to that contract.
Real Exploit Examples
| Incident | Attack Vector | Loss |
|---|---|---|
| Wallet now (2024) | Rogue developer upgraded contract, drained infinite approvals | $1M+ |
| Multichain (2023) | Protocol compromise, users with infinite approvals drained | $3M+ |
| Various rug pulls | Developer exploits infinite approvals after building trust | Varies |
In each case, users who had granted infinite approvals lost funds — even though they weren’t actively using the protocol at the time of the exploit.
How Attackers Exploit Infinite Approvals
Scenario 1: Protocol Compromise
A legitimate protocol’s admin key, multisig, or upgrade mechanism is compromised. The attacker uses the protocol’s existing allowances to drain user wallets:
- Users have approved the protocol for unlimited tokens
- Attacker gains control of the protocol’s contract
- Attacker calls
transferFrom()to move user tokens to their address - Users are drained without having signed any new transaction
You don’t need to make a mistake for this to happen. The approval you signed months ago is still valid.
Scenario 2: Phishing Approval
A phishing site tricks you into approving a malicious contract for unlimited tokens:
- You visit a fake DEX clone
- The site requests a standard token approval — looks normal
- You approve unlimited tokens for the attacker’s contract
- The attacker calls
transferFrom()and drains your tokens
Unlike signature scams, this attack requires an on-chain transaction (you pay gas for the approval). But the approval itself looks identical to a legitimate one.
Scenario 3: Approval + Frontend Compromise
A legitimate protocol’s frontend is compromised (DNS hijack, compromised CDN, malicious update). The frontend is modified to route approvals to an attacker’s contract instead of the real protocol:
- You visit the real domain (but the frontend is compromised)
- You approve tokens as usual
- The approval goes to the attacker’s contract, not the protocol’s
- Your tokens are drained
This is particularly insidious because the URL is correct, the branding is correct — only the underlying contract address has been swapped.
How to Audit Your Token Approvals
Method 1: revoke.cash (Recommended)
revoke.cash is a free tool that scans your wallet for active token approvals across multiple chains:
- Connect your wallet (read-only, no signing required)
- Review all active approvals, sorted by risk
- Revoke any approvals you don’t actively need (costs gas)
Rule of thumb: If you haven’t used a protocol in the last 30 days, revoke its approval.
Method 2: Etherscan Token Approval Checker
- Go to etherscan.io/tokenapprovalchecker
- Enter your address
- Review active approvals
Less feature-rich than revoke.cash but doesn’t require wallet connection.
Method 3: Manual Check
On Etherscan, read the token contract’s allowance() function:
- Owner: your address
- Spender: protocol contract address
- Returns: remaining allowance
This is tedious for multiple tokens/protocols but gives precise control.
Defense: The Approval Hygiene Protocol
1. Approve Exact Amounts When Possible
Many DEX interfaces (Uniswap, 1inch, Paraswap) let you toggle between “Unlimited” and “Exact” approval:
- Exact approval: Approve only the amount you’re swapping. Safer, but you pay approval gas every time.
- Unlimited approval: Approve once, swap unlimited times. Cheaper, but riskier.
If your wallet supports it, default to exact approvals for amounts over $1,000.
2. Use Approval-Expiration Features
Some newer token standards and protocols support time-limited approvals:
- Permit2 (Uniswap): Allows permits with deadlines — but the underlying approval to Permit2 is still unlimited. See our Permit2 guide for nuance.
- Rari’s Time-Locked Approvals: Approvals that automatically expire after a set duration
When available, choose time-limited over permanent approvals.
3. Regular Revocation Audits
Schedule a monthly approval audit:
- Visit revoke.cash
- Filter by chain (Ethereum, Arbitrum, Base, etc.)
- Revoke approvals for protocols you haven’t used recently
- Cost: $5-30 in gas per revocation — cheap insurance
4. Separate Interaction Wallets
- Hold wallet: Stores significant token holdings. Zero active approvals. Never interacts with DeFi directly.
- DeFi wallet: Contains only what you need for active trading. Has necessary approvals. If compromised, limited blast radius.
5. Verify Contract Addresses
Before approving any token, verify the spender contract address:
- Cross-reference with the protocol’s official documentation
- Check the address on our token risk scoring API or address risk checker
- Use Etherscan to confirm the contract is verified and belongs to the expected project
Infinite Approval vs. Permit2 vs. Signature Scams
These three attack vectors are related but distinct:
| Attack | Requires On-Chain Tx? | Gas Paid By | Scope | Reversible? |
|---|---|---|---|---|
| Infinite Approval | Yes (approval tx) | User | One token, one spender | Yes (revoke) |
| Permit2 Signature | No (off-chain sig) | Attacker | All Permit2-approved tokens | No |
| Signature Scam | Depends on variant | Usually attacker | Varies | Usually no |
See our guides on Permit2 exploits and signature scams for the other vectors.
Frequently Asked Questions
Q: How much does it cost to revoke an approval?
A: A revocation is a standard ERC-20 approve(spender, 0) transaction. On Ethereum mainnet, it typically costs $2-15 depending on gas prices. On L2s (Base, Arbitrum), it’s usually under $0.50.
Q: If a protocol gets hacked, will revoking my approval save me?
A: Only if you revoke before the attacker drains your allowance. Once the protocol is compromised, the attacker can call transferFrom() instantly. Revocation is preventive, not reactive.
Q: Are infinite approvals ever safe?
A: Infinite approvals to well-audited, long-running protocols with no admin keys (fully decentralized) carry lower risk. But “lower risk” is not “no risk.” Even Uniswap V3 Router could theoretically be compromised through a governance attack or bug in its permit logic.
Q: What about NFT approvals?
A: NFTs use setApprovalForAll() instead of approve(). The risk is similar — granting setApprovalForAll(contract, true) lets the contract transfer ALL your NFTs of that collection. Audit these on revoke.cash too.
Q: Can I see approvals across multiple chains in one place?
A: Yes. revoke.cash supports Ethereum, Arbitrum, Base, Optimism, Polygon, BSC, and several other chains. Etherscan’s approval checker is Ethereum-only.