What are token approvals and why they can drain your wallet

Token approvals let smart contracts move your tokens — often with no limit and forever. Learn how approvals work, why they are risky and how to check yours for free.

Every time you swap on a DEX, bridge, stake or list an NFT, your wallet asks you to sign an approve transaction. It gives a smart contract (the spender) permission to move a specific token out of your wallet.

Why approvals are dangerous

• They are usually unlimited. Most dApps request the maximum amount (2²⁵⁶−1) so you don't have to approve again. That spender can move all of that token — today and in the future.
• They never expire. An approval you gave in 2022 to a protocol you forgot about is still active today.
• Contracts get hacked. When a protocol's router or contract is exploited, attackers drain every wallet that approved it — even users who haven't touched it in years.
• Phishing drainers use them. Fake airdrop and mint sites ask you to sign an approval (or a Permit / Permit2 signature) to an attacker's address. One signature is enough.

ERC-20, NFTs and Permit2

ERC-20 tokens use approve(spender, amount). NFT collections use setApprovalForAll(operator, true) — one signature gives access to every NFT in the collection. Permit2 adds a second layer: tokens approved to Permit2 can be spent by apps that hold a Permit2 allowance from you.

How to protect yourself

1. Scan your wallet for active approvals on every chain you use.
2. Revoke anything unlimited, anything you no longer use, and anything to an unknown contract.
3. Repeat after every new dApp you try — it takes 30 seconds.

Revokly scans Ethereum, BNB Chain, Base, Arbitrum, Optimism and Polygon at once and revokes in one click. It is free and runs in your browser — Revokly never sees your private key.