Ecosystem
Token approvals explained: the DeFi permission most people forget they gave
· 4 min read
The first time you swap a token on a DEX, you usually sign two transactions, not one. The first is labelled Approve. The second is the swap itself. Most people click through the approval without a second thought.
That approval is a standing permission for a smart contract to move your tokens. It often has no limit and no expiry. It stays active long after you've forgotten the app. Understanding approvals is one of the simplest ways to make your wallet safer.
Why approvals exist
On Ethereum and compatible networks, most tokens follow the ERC-20 standard. An ERC-20 token lives in its own smart contract, which keeps a record of who owns how much. A DEX contract can't simply reach into your wallet and take tokens to complete a swap.
So the standard includes two steps:
- Approve. You tell the token contract: "Let this specific DEX contract spend up to X of my tokens."
- Transfer. When you swap, the DEX contract pulls the approved amount and completes the trade.
The amount you approve is called an allowance. It's recorded on-chain and stays there until it's used up or you change it.
Native coins like ETH work differently. You send them directly with the transaction, so they need no approval. That's why swapping from ETH often takes one step, while swapping from a token takes two.
The catch: unlimited approvals
To save you fees on future swaps, many apps request an unlimited allowance by default. You approve once and never pay for another approval for that token on that app.
The convenience has a cost. An unlimited approval means the contract can move all of that token you hold, now or in the future. If the contract is later exploited, or if you approved a malicious contract by mistake, an attacker can drain that token without asking you again.
This isn't theoretical, and the bigger risk is not that a contract you trusted gets hacked later. More often the approval is malicious from the start: a scammer persuades you to approve an address they control, then empties that token whenever they choose, without ever touching your private key. Chainalysis counted over $2.7 billion lost to approval phishing between May 2021 and July 2024.
| Approval type | Convenience | Risk if the contract is compromised |
|---|---|---|
| Exact amount | New approval for every swap | Limited to the amount approved and not yet used |
| Unlimited | Approve once, swap forever | Every unit of that token in your wallet |
Signature-based approvals: Permit and Permit2
Newer standards let you grant approvals by signing a message instead of sending a transaction. Examples include the EIP-2612 Permit extension and Uniswap's Permit2 contract. These save gas, and Permit2 can attach expiry times to approvals.
They also introduce a new risk. A signature costs nothing and doesn't appear as a transaction, so phishing sites ask users to "sign in" with what is actually a permit. Once signed, the attacker can use it to move tokens. Treat any signature request with the same care as a transaction.
How to stay safe
- Approve exact amounts when you can. Many wallets let you edit the allowance before you confirm. Paying an extra approval fee later is cheaper than losing a balance.
- Read what you sign. Check the contract address and the amount. If a site you've never used asks for an unlimited approval on your largest holding, stop.
- Be suspicious of signature requests. Words like "Permit", "spender" or "deadline" in a signature prompt mean you're granting spending rights.
- Review your approvals regularly. Block explorers such as Etherscan offer a token approval checker, and tools like Revoke.cash list every active allowance per network.
- Revoke what you no longer use. Revoking sets the allowance to zero. It's an on-chain transaction, so it costs a small fee, which is lower on Layer 2s.
- Check every network. Approvals are per chain. An allowance on Arbitrum isn't visible when you check Ethereum.
- Separate your wallets. Keep long-term holdings in one wallet and use another, with smaller balances, for trying new apps.
The takeaway
A token approval is a key you hand to a smart contract. Most of the time it's needed and harmless. But keys pile up, and some stay valid for years. Approve only what you need, read before you sign, and clear out old approvals every few months. Of all DeFi safety habits, this one does the most for the least effort.
Sources: Chainalysis, Operation Spincaster, July 2024, for the $2.7 billion lost to approval phishing since May 2021; EIP-2612 and Uniswap's Permit2 documentation for the signature-based approval standards.
Disclaimer: These materials are for general information purposes only and do not constitute financial, investment, tax, or legal advice, nor a recommendation or solicitation to buy, sell, stake, or hold any crypto-asset. LCX Liberty Labs will not undertake efforts to increase the value of any crypto-asset that you buy. Crypto-assets are highly volatile and you may lose your entire investment. Past performance is not indicative of future results. Some crypto products and markets are unregulated, and you may not be protected by government compensation or regulatory protection schemes.