When you interact with a decentralized exchange or any DeFi protocol, you grant it a token approval — a permission that allows the contract to move tokens from your wallet. This is standard mechanics. But every approval you sign is a key you hand to a smart contract. If that contract is malicious, or becomes malicious later through a proxy upgrade, your tokens are gone — no further signature required.

Most users accumulate dozens of approvals over months of DeFi activity and never think about them again. This guide explains how approvals work, why they’re a top attack vector, and how to clean them up.

BLUF: A token approval authorizes a smart contract to spend tokens on your behalf. Unlimited approvals (the default on most DEXs) are the most dangerous — they let a compromised contract drain your entire balance at any time. Audit your active approvals regularly using revoke.cash or Etherscan, and revoke any you no longer use.

How Token Approvals Work

Token approvals use the ERC-20 approve() function. When you approve a contract, you set two parameters:

  1. Spender address — the contract allowed to spend your tokens
  2. Amount — how many tokens the contract can spend
approve(spenderAddress, amount)

Once approved, the spender contract can call transferFrom() to move your tokens — without any further action from you. No popup, no confirmation, no notification. The permission persists until you explicitly revoke it.

Unlimited Approvals: The Default Danger

Most DEXs and DeFi frontends default to unlimited approvals — setting the amount to type(uint256).max (approximately 1.15 × 10^77 tokens). This is done for UX convenience: instead of approving the exact amount for each trade, you approve once and can trade forever.

The trade-off: if that DEX contract is ever compromised — through a private key leak, a proxy upgrade, or a reentrancy exploit — the attacker can drain every token you’ve ever approved, not just the ones you intended to trade.

The Approval Lifecycle

StageWhat HappensRisk
ApproveYou sign a transaction granting permissionLow — you chose to interact
ActiveThe contract can spend your tokens at any timePersists silently
ExploitAttacker uses the approval to drain tokensFunds lost without any new signature
RevokeYou set approval amount to 0Permission removed — safe

The gap between “Active” and “Exploit” can be months or years. You might forget you ever interacted with a protocol — but the approval remembers.

Why This Is a Top Attack Vector

Scenario 1: Compromised Protocol

You approve a new yield farming protocol. Three months later, the protocol’s deployer key is phished. The attacker upgrades the contract via its proxy pattern to include a drain function. Every wallet that ever approved the contract gets emptied. No additional user interaction needed.

This happened to hundreds of users across multiple protocols in 2024–2025.

Scenario 2: Malicious Token Airdrop

You receive an unsolicited token in your wallet — a common airdrop tactic. To “claim” the associated reward, you visit a website that asks you to approve a token swap. The approval targets a malicious contract disguised as a DEX router. Once approved, the contract drains your legitimate tokens.

Scenario 3: Frontend Compromise

A legitimate DeFi protocol’s frontend is compromised (DNS hijack, XSS, or social engineering of the domain). The malicious frontend presents normal-looking trade prompts, but the approval targets an attacker-controlled contract. Users who approve lose funds — even though they thought they were using the real protocol.

How to Audit Your Active Approvals

revoke.cash is a free tool that scans your wallet for active token approvals across multiple chains.

  1. Connect your wallet (read-only is sufficient)
  2. Select the chain (Ethereum, Base, Arbitrum, etc.)
  3. Review the list of active approvals — sorted by risk level
  4. Click “Revoke” on any approval you no longer need

Each revocation is an on-chain transaction that sets the approval amount to 0. You’ll pay a small gas fee per revocation.

Method 2: Etherscan Token Approval Checker

  1. Go to Etherscan → connect your wallet via the “More” dropdown
  2. Navigate to Token Approval Checker
  3. Select the token contract
  4. Review the allowance entries

This method is chain-specific — you need to check each chain separately.

Method 3: Direct Contract Read

For developers, call the ERC-20 allowance() function directly:

allowance(ownerAddress, spenderAddress) → uint256

Any non-zero return value is an active approval. This is useful for automated monitoring.

Best Practices

1. Use exact-amount approvals when possible

Some modern DEXs support “permit2” or exact-amount approvals. Instead of approving unlimited tokens, you approve only the amount needed for the current trade. Slightly more gas per trade, but eliminates the lingering-permission risk entirely.

2. Revoke after interacting with new protocols

After trying a new protocol, revoke the approval immediately if you don’t plan to use it regularly. Make this a habit.

3. Treat unsolicited tokens as traps

Tokens that appear in your wallet without you claiming them are almost always bait. Never interact with them — don’t swap them, don’t approve them, don’t visit any URL in their token name or memo.

4. Verify contract addresses before approving

Before signing any approval, cross-check the spender contract address against the protocol’s official documentation or a trusted registry like DeFiLlama. A single character difference in the address is the difference between a safe trade and total loss.

5. Check for proxy contracts

If the contract you’re approving uses a proxy pattern, its logic can change at any time. Check whether the implementation address is controlled by a multi-sig wallet or a single EOA. A single-key upgrade path means one compromised key can turn a safe contract malicious overnight.

Monitoring Approvals Programmatically

For power users and security teams, active monitoring is more effective than periodic manual audits. You can:

  • Query approval events on-chain by filtering for Approval events where the owner is your address
  • Use our address risk scoring API to check whether any spender contract you’ve approved is flagged for phishing, honeypot, or sanctions associations
  • Set up alerts using tenderly.co or fortanix for any new approval transaction from monitored wallets

The key insight: approvals are not just permissions — they are standing vulnerabilities. Treat them with the same seriousness as exposed private keys.

Further Reading