Coin98

Trader

Security

USDC

Token

<p>A token approval is an on-chain permission, granted by calling a smart contract’s <code>approve()</code> function, that lets another contract move a set amount of a specific token out of your wallet whenever it wants, without asking again. Revoking one sets that allowance back to zero – it stops future use of that permission, but it does not undo a transfer that has already happened.</p>
<h2 id="what-approve-actually-grants">What approve() actually grants</h2>
<p>Most ERC-20 tokens, the standard used by the large majority of tokens on Ethereum and compatible chains, follow a pattern that gives a smart contract no default access to a wallet’s balance. Before a decentralized exchange, lending protocol or NFT marketplace can move a user’s tokens, the user must call <code>approve()</code> on the token’s own contract, naming a spender address and an amount, according to Blockscout, Coin98, Ledger Academy and MetaMask. Once that transaction confirms, the spender contract can call a second function, <code>transferFrom()</code>, to move up to the approved amount at any time – without a further signature from the wallet owner, per the same sources. MetaMask illustrates the everyday version of this: swapping USDC for ETH on a decentralized exchange requires one transaction to approve the exchange’s contract to spend the USDC, and a second to execute the swap itself.</p>
<p>Two details matter, per MetaMask’s account. The approval is specific to one token and one spender – approving a decentralized exchange to spend USDC gives it no access to ETH or any other token in the wallet. And the approval itself is a blockchain transaction that costs a network fee, separate from whatever action prompted it.</p>
<h2 id="limited-versus-unlimited-approvals">Limited versus unlimited approvals</h2>
<p>The amount field in an approval determines the ceiling. A limited approval authorizes a specific quantity – MetaMask’s example is exactly the 500 USDC needed for one swap – and once that amount is used, a fresh approval transaction is required for the next one. An unlimited approval authorizes the maximum possible value a token contract can express, 2^256-1, a number MetaMask notes is far larger than the total supply of any real token. Practically, that means the spender can move the wallet’s entire balance of that token, at any point in the future, with no further approval needed.</p>
<p>Most dApps default to requesting unlimited approvals because it removes repeat transaction fees for the user, a tradeoff described by Blockscout, Coin98 and MetaMask alike. The cost of that convenience is that the permission never expires on its own. Blockscout puts it plainly: token approvals do not expire automatically. If the contract that holds an unlimited approval is later exploited, upgraded maliciously, or turns out to have been untrustworthy from the start, an attacker can drain the full approved balance without the victim signing anything at that moment.</p>
<h2 id="how-the-exploit-actually-runs">How the exploit actually runs</h2>
<p>MetaMask’s account of wallet-drainer operations breaks the sequence into three steps: a lure (a phishing site, fake airdrop link, or cloned app interface), a signature request dressed up as a routine connection or claim, and then the drain, in which the attacker calls <code>transferFrom()</code> from a separate wallet to pull the tokens the approval already authorized. MetaMask notes that sophisticated kits batch multiple approvals – ERC-20s, NFTs, Permit2 signatures – into a single multicall that can empty a wallet in seconds, then route funds through exchanges and bridges. Coin98 cites a concrete case: in January 2026, the SwapNet exploit on the Matcha Meta platform drained approximately $13.4 million from 20 users, according to The Block as cited by Coin98, specifically those who had disabled the platform’s default one-time approval and granted direct unlimited allowances instead. Attackers then exploited an input-validation flaw to call <code>transferFrom()</code> against those standing approvals. Coin98 separately cites Ledger Academy for a $3 million theft on the NFT Trader platform, attributed to attackers exploiting forgotten <code>SetApprovalForAll</code> grants; no date is given for that incident.</p>
<p>The scale cited by Coin98, drawing on DeepStrike’s figures, is that approval scams and compromised contracts drained more than $410 million from crypto users in the first half of 2025. Separately, MetaMask’s own February 2026 Crypto Security Report recorded a 207% rise in signature-phishing exploits, the term MetaMask uses for approval phishing conducted through signed messages rather than on-chain transactions.</p>
<h2 id="reading-and-revoking-an-approval">Reading and revoking an approval</h2>
<p>An approval shows up on-chain as an <code>Approval</code> event, with three fields visible on a block explorer: the owner wallet, the spender contract, and the value approved, per Blockscout’s walkthrough. Revoking means submitting a new transaction that sets that allowance back to zero for a given spender – Coin98 and MetaMask both describe this as an on-chain action that itself costs a network fee. Named tools for doing this across the sources held include Etherscan’s Token Approval Checker, per Coin98; block explorers such as Etherscan and Polygonscan more broadly, described by Cointelegraph as having approval sections with token approval tools, though Cointelegraph does not name a specific tool; the standalone site Revoke.cash, per Coin98; Coin98’s own Wallet Approval feature built into its Super Wallet; and Blockscout’s Revokescout, built directly into its explorers across chains including Ethereum, Base, Optimism and Arbitrum. Coin98 suggests auditing approvals after a major protocol incident, after ending use of a dApp, or on a monthly schedule; none of the sources describe this as a complete defense, only as one specific habit that closes one specific exposure.</p>
<h2 id="permit2-moving-the-risk-off-chain">Permit2: moving the risk off-chain</h2>
<p>Uniswap Labs deployed a contract called Permit2 in November 2022, according to MetaMask, to reduce both the friction and the standing-approval risk of the legacy model. Instead of granting a separate on-chain approval to every app, a user approves the Permit2 contract once per token; individual app interactions after that are authorized by an off-chain signature specifying the token, amount, spender and a deadline. MetaMask reports that more than 3.1 million Ethereum mainnet addresses had authorized Permit2 by 2025, and that it is used by Uniswap, 1inch, CowSwap and other protocols. Ledger Academy describes Permit2 as extending the benefits of the ERC-2612 permit standard to all tokens, with what it calls automatic expiration built in. The tradeoff, per MetaMask, is a shift in attack surface rather than its removal: legacy approvals were exploited through dormant on-chain permissions discovered later; Permit2 signatures are instead exploited at the moment of signing, because they appear in a wallet as a message to sign rather than a transaction to confirm, and a phishing site can present a disguised Permit2 authorization as a routine request.</p>
<h2 id="what-this-page-does-not-tell-you">What this page does not tell you</h2>
<p>This page cannot tell a reader how much value is currently exposed across all wallets. The loss figures cited here – DeepStrike’s $410 million for the first half of 2025, The Block’s $13.4 million SwapNet figure for January 2026, Coin98’s $3 million NFT Trader figure citing Ledger Academy with no date attached – are single-outlet or third-party estimates for specific periods or incidents, not an audited running total, and none of the newsrooms held in full offer a reconciled figure across all of them. Revoking an approval does not reverse a theft that has already occurred; it only prevents further use of that specific allowance going forward. Based on the mechanism as MetaMask and Ledger Academy describe it – a single on-chain approval to the Permit2 contract, followed by off-chain signatures per app – the read here is that revoking an unrelated legacy ERC-20 approval would not undo a Permit2 signature already given; ending that would require either the signature’s own deadline passing or revoking the underlying Permit2-level authorization. None of the sources held, however, spell out the exact revocation procedure for a live Permit2 signature, so this is an inference from the mechanism, not a reported fact. Neither action – legacy revocation or Permit2 revocation – addresses private-key theft or seed-phrase phishing, which are separate attack surfaces this page does not cover in depth. Whether MetaMask’s 3.1-million-address Permit2 figure has been verified independently on-chain, or reflects MetaMask’s own count, is not stated in the material reviewed for this page.</p>
<h2 id="sources">Sources</h2>
<p>Every fact above is attributed to one of these reports. Where they disagree, the article says so.</p>
<ul>
 <li><a href="https://www.cryptotimes.io/2026/08/19/sec-proposes-new-crypto-rules-with-75m-offering-exemption/" rel="noopener noreferrer nofollow">TheCoinrise reference desk</a></li>
 <li><a href="https://www.coindesk.com/policy/2026/08/18/r" rel="noopener noreferrer nofollow">TheCoinrise reference desk</a><em>(headline only)</em></li>
 <li><a href="https://www.bloomberg.com/news/articles/2026-08-18/sec-proposes-some-registration-exemptions-for-crypto-offerings" rel="noopener noreferrer nofollow">TheCoinrise reference desk</a><em>(headline only)</em></li>
 <li><a href="https://www.blog.blockscout.com/token-approvals-wallet-risk-security-guide-revoke/" rel="noopener noreferrer nofollow">TheCoinrise reference desk</a></li>
 <li><a href="https://coin98.com/blog/token-approvals-explained-what-they-are-and-why-they-matter/" rel="noopener noreferrer nofollow">TheCoinrise reference desk</a></li>
 <li><a href="https://www.ledger.com/academy/ethereum-token-approvals-explained" rel="noopener noreferrer nofollow">TheCoinrise reference desk</a></li>
 <li><a href="https://metamask.io/news/what-are-token-approvals" rel="noopener noreferrer nofollow">TheCoinrise reference desk</a></li>
 <li><a href="https://cointelegraph.com/news/how-to-revoke-smart-contract-access-to-your-cryptocurrency" rel="noopener noreferrer nofollow">TheCoinrise reference desk</a></li>
</ul>
<p>The post <a href="https://thecoinrise.com/what-token-approval-grants-how-to-revoke/" rel="noopener noreferrer nofollow">What a token approval grants, and how to revoke one</a> appeared first on <a href="https://thecoinrise.com/" rel="noopener noreferrer nofollow">TheCoinrise.com</a>.</p>

What a token approval grants, and how to revoke one

Table of Contents

TheCoinrise Media

Other articles published on Aug 19, 2026

Join our free newsletter for daily crypto updates!