Token approvals and wallet drainers

What is a token approval?

Fungible tokens on Ethereum and compatible networks commonly follow the ERC-20 standard. It includes a two-step way to let someone else move your tokens. First you call approve, which the standard describes as allowing a spender to withdraw from your account multiple times, up to a set amount. Later the spender calls transferFrom to actually move them. A third function, allowance, shows how much the spender may still take.

This exists for good reasons. A decentralized exchange cannot pull your tokens into a trade unless you have allowed its smart contract to do so. The problem is that the permission is not tied to one trade. It stays on the blockchain until it is used up or you change it.

NFTs have a broader version. The ERC-721 standard's setApprovalForAll lets an "operator" manage all of an owner's NFTs in that collection, not just one.

Why are unlimited approvals risky?

To save users repeat fees, many apps ask for permission to spend an unlimited amount of a token, ethereum.org explains. ERC-20 stores an allowance as a 256-bit number, so the largest possible value is 2²⁵⁶ − 1, a 78-digit figure; an "unlimited" approval is, for practical purposes, permission to take every unit you will ever hold. Ethereum.org warns that with unlimited access a platform can spend all of those tokens, even after you have withdrawn your funds from it back to your wallet.

Ethereum.org's security guide is direct: do not allow unlimited spend limits; set the limit to the amount the transaction needs.

How do wallet drainers use approvals and signatures?

A wallet drainer is a scam built to get a victim to grant spending rights, then move the tokens out. Ethereum.org's scam guidance says scammers often trick users into approving unlimited token spending. The bait is often a fake airdrop or a cloned website that asks you to "connect" and then "approve" or "sign".

Signatures matter because of EIP-2612, the permit standard. It lets a token holder change an allowance with a signed message instead of an on-chain transaction, and the standard says anyone can then submit that signature to the token contract. In other words, a request that looks like a harmless off-chain signature, with no gas fee, can create a real approval once a third party submits it.

How do you check and revoke token approvals?

Ethereum.org's guide to revoking access lays out the process. Block explorers and dedicated approval checkers can list your current allowances; we do not recommend specific tools.

1. Open an approval checker you have reached directly, not through a link someone sent you.

2. Connect your wallet and choose the network. Approvals are per network, so check each one you use.

3. Review the list. Look for unlimited allowances, apps you no longer use and spenders you do not recognize.

4. Revoke. This sends a transaction that resets the allowance, and you pay the usual gas fee.

5. Confirm. Refresh after a few minutes to check the approval is gone.

What approval mistakes do beginners make?

• Clicking Approve on autopilot. Read the spender and the amount. If the wallet shows "unlimited" and you only need a small swap, edit the amount if your wallet allows it.
• Treating a signature as harmless. A signed permit can become a real approval. If a site you do not trust asks you to sign, refuse.
• Leaving old approvals in place. An app you used once two years ago may still be able to spend your tokens.
• Trying new apps with your savings wallet. Bitcoin.org's general advice is to keep only small amounts on everyday, online wallets; the same logic suggests testing unfamiliar apps from a wallet holding little. See hardware vs software wallets.
• Engaging with unknown tokens. Ethereum.org warns that scam airdrops lead to sites that ask for signatures. See phishing and address poisoning.