What is a token approval?
An approval lets a contract spend your asset, up to an allowance you set. It is not a transfer. The asset stays at your address, but the spender can move it at any time within that allowance — even without your knowledge.
What is the risk of an unlimited approval?
With an unlimited allowance, the spender can move your entire balance of that token, and the allowance does not shrink when you move assets out. If that contract has a flaw, or an attacker controls it, your assets can be wiped out in a single transaction.
What happens when you revoke an approval?
Revoking sets the allowance to zero. The spender can no longer move that asset. Keep using the DApp and you will have to approve again. The revoke is itself an onchain transaction, so it costs gas.
What is a Permit approval?
Permit lets you grant an approval with one signature instead of an onchain transaction, which saves the gas. The trade-off: if the signature leaks, an attacker can use it for as long as it stays valid, and revoking a transaction cannot cancel it.
What is account delegation (EIP-7702)?
EIP-7702 lets your account hand execution rights to another piece of code. That is far more power than a normal approval: the delegate can act as your account and do almost anything. Its risk has to be assessed on its own.
Common scam tactics
Fake DApp front ends, fake airdrop claim pages, fake support asking for your seed phrase, forged “security check” tools, Permit signatures you do not understand. They are all after the approvals you already hold.
Real incidents and responses
Every incident ships with evidence, scope, the reviewer, and an update time. We do not publish claims we cannot verify.
Content published on the platform
Learn about common approval risks, scam tactics, and how to protect yourself.
What to do next
The fastest way to understand the risk is to see the real approval list for your own wallet.