Token Approvals and Revoking Access

What an approval actually is

A token balance is a number recorded inside the token's own contract, not an object sitting in your wallet. When an application needs to move that token for you, it cannot simply take it: the token contract only moves balances when the owner has authorised a spender.

An approval writes that authorisation into the token contract: this address may move up to this amount of this token from my address. It stays in place until you change it or it is fully spent.

Allowance, spender and unlimited approvals

• Allowance — the maximum amount the spender is permitted to move. It is per token and per spender.
• Spender — the contract address receiving the permission. It is not necessarily the website you are looking at, which is why verifying the site does not by itself verify the contract.
• Unlimited approval — an allowance set to an effectively infinite value so the application never has to ask again. Convenient, and the reason a single compromised or malicious contract can drain an entire token balance long after the interaction.
• Standing permission — an approval does not expire on its own, does not require you to be online, and does not notify you when it is used.

An approval and a transfer are different actions. Approving does not move anything immediately; it grants permission for later. Losses frequently happen weeks or months after the approval was signed.

Approvals versus signatures

• An on-chain transaction changes state and costs a network fee. An approval transaction is one of these.
• An off-chain signature costs nothing and produces no explorer entry — but some signature types are still authorisations. Permit-style signatures let a contract set an allowance later using your signed message, and order signatures can authorise a transfer of assets under trading rules.
• Because a gasless signature feels harmless, it is the preferred technique of wallet drainers. A request that will not clearly state what it authorises should be rejected.
• A plain login or 'prove you own this address' message signature is normal — but only when you initiated it on a site you reached through your own bookmark.

How approvals are abused

• A fake claim, airdrop or minting page asks for an unlimited approval as part of 'claiming', then moves the tokens later.
• A cloned interface at a look-alike domain presents the real application's flow with the spender address swapped for the attacker's contract.
• A legitimate contract with an old outstanding approval is later exploited, and every address that still has an allowance to it is exposed.
• An unsolicited token is deposited into your wallet, and interacting with it routes you through a malicious approval.

How to inspect what you have approved

1. Start inside your own wallet software. Several mainstream wallets include a permissions, approvals or connected-sites screen, and that is the safest place to look because you did not have to visit a new site.
2. Otherwise use the major block explorer for that network, reached from the network's own official documentation and then bookmarked. Explorers commonly expose a token-approval view for an address.
3. Check the exact domain in the address bar character by character before connecting anything. Impersonation of approval tools is common precisely because the audience is already worried.
4. Review one network at a time: allowances exist separately on every chain where you have used an address.
5. Ignore any tool that asks for a recovery phrase or private key. No approval check needs either.

We do not link to third-party approval-checking sites. Use your wallet's own screen or the explorer named in the network's official documentation, and verify the domain yourself.

How revoking works

• Revoking sets the allowance for a spender back to zero. Some interfaces also let you reduce an allowance instead of clearing it.
• It is an on-chain transaction, so it costs a network fee on the network where the approval exists. Revoking on one chain does nothing on another.
• Once confirmed, the spender can no longer move that token from your address. Nothing else about your wallet changes.
• Approvals you still need will be requested again the next time you use the application.

What revoking does not fix

Revoking is preventive, not restorative. Anything already moved under an approval is gone: the transfer was valid and confirmed, and no one can reverse it.

• If tokens were taken and you still control the wallet, revoke the remaining approvals and move the rest of the assets to a new wallet.
• If your recovery phrase or private key was exposed, revoking is useless. The attacker controls the account itself and can sign anything, including new approvals. The only response is a brand-new wallet with newly generated recovery material and an immediate migration.
• A wallet that has been drained while you still hold the keys is a signature or approval problem. A wallet drained across multiple networks or assets simultaneously usually indicates key compromise.

Habits that keep approvals manageable

• Prefer a specific amount over an unlimited allowance whenever the interface offers the choice.
• Keep a separate wallet with a small balance for interacting with applications, so an approval can only reach what is in it.
• Review approvals periodically, and revoke everything you no longer use rather than leaving permissions standing indefinitely.
• Reach applications through your own bookmarks, and re-verify the domain before every connection.
• Reject any request whose effect you cannot state in one sentence.

Sources

• Ethereum.org: ERC-20 token standard (approve and allowance)
• Ethereum.org: security
• Ethereum.org: transactions
• FBI Internet Crime Complaint Center