What are malicious token approvals?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
A token approval grants a contract permission to move your tokens. Malicious sites dress that request up as a simple connect or claim step and ask for an unlimited allowance. The permission takes effect the moment you sign and stays alive until you revoke it, so approvals need to be reviewed periodically.
Key points
- An approval hands over permission to move your tokens
- An unlimited allowance covers your entire balance
- Check which token and what limit the prompt requests
- Revoke approvals once you are done with the app
Definition
A standard token feature that authorises a named contract to move your balance. Granted without a limit to a hostile contract, it lets that contract drain the balance at a time of its choosing.
To trade a token on a decentralised exchange you first authorise its contract to move your balance. That is normal and necessary. The trouble is that the allowance can be unlimited, and the wording on a signing prompt is hard for most people to read.
Hostile sites disguise the request as claiming an airdrop, minting an NFT or simply connecting a wallet. Funds do not necessarily move right away — a drain days later is common — so 'I signed and nothing happened' is not evidence that the approval was safe.
Read three things on the prompt: which token is involved, which address is being authorised, and the spending limit. If the limit reads unlimited or an absurdly large number, stop there. If the wallet cannot show you what the request does at all, stopping is equally correct.
Approvals never expire on their own. Use a block explorer's approval view or your wallet's permissions screen to list the ones currently active and revoke those you no longer use. Revoking costs a network fee, which is small next to the balance it protects.
Watch out for
- · Read the token, the spender address and the limit on every approval prompt, and refuse unlimited allowances
- · Revoke approvals for apps you have finished using, as a regular habit
- · Keep a separate everyday wallet for connecting to apps, and never connect the wallet that holds savings