| name | token-approval-safety |
| description | Guide to ERC-20 token approvals — how they work, why unlimited approvals are risky, how to check and revoke approvals, and best practices. Use when helping users manage approvals, audit wallet security, or understand approval-related risks. |
| metadata | {"openclaw":{"emoji":"✅"}} |
Token Approval Safety Guide
Token approvals are one of the most overlooked security risks in DeFi. This guide helps AI agents protect users from approval-related attacks.
How Approvals Work
When you interact with a DeFi protocol, you must first "approve" it to spend your tokens:
1. You call approve(spenderAddress, amount) on the token contract
2. The spender (DEX, protocol) can now transfer up to `amount` of your tokens
3. When you swap/deposit, the protocol calls transferFrom() to move your tokens
The Problem: Unlimited Approvals
Most DeFi UIs request unlimited approval (type(uint256).max):
- Saves gas on future interactions (no re-approval needed)
- But: the protocol can spend ALL your tokens FOREVER
- If the protocol gets hacked, attackers drain your tokens via the approval
Risk Levels
| Approval Type | Risk | When to Use |
|---|
| Exact amount | Low | Large deposits, untrusted protocols |
| Limited amount | Medium | Regular use with trusted protocols |
| Unlimited | High | Only with battle-tested protocols (Uniswap, Aave) |
| Permit (EIP-2612) | Medium | Gasless approvals, common in modern DeFi |
How to Check Approvals
On-Chain (Direct)
Query the token contract: allowance(ownerAddress, spenderAddress)
Tools
What to Look For
- Unlimited approvals to contracts you no longer use
- Approvals to unknown contracts you don't recognize
- Old approvals from months/years ago
- Approvals for valuable tokens (USDC, USDT, WETH)
Revoking Approvals
Revoking sets the allowance to 0:
approve(spenderAddress, 0)
Cost: Small gas fee per revocation
When to revoke:
- After you're done using a protocol
- If a protocol announces a security incident
- During regular security checkups (monthly recommended)
- Before a token migration or contract upgrade
Common Attack Vectors
1. Approval Phishing
Attacker tricks you into approving a malicious contract:
- Fake DEX frontends
- Phishing links disguised as protocol UIs
- "Claim airdrop" scam sites
Prevention: Always verify the contract address before approving
2. Compromised Protocol
If a protocol with your approval gets hacked:
- Attacker can drain your approved tokens immediately
- They don't need your private key — just the approval
Prevention: Use exact-amount approvals, revoke unused approvals
3. Permit Signature Phishing
EIP-2612 permits are signed off-chain (no gas). Attackers can trick you into signing a permit that grants them unlimited approval:
- Looks like a harmless "sign this message" request
- Actually authorizes token spending
- No on-chain transaction to alert you
Prevention: Read what you're signing carefully, use wallets that show permit details
Best Practices
For Regular Users
- Use exact-amount approvals when possible
- Review approvals monthly using Revoke.cash
- Revoke approvals to protocols you no longer use
- Use a dedicated DeFi wallet — don't hold all tokens where you approve
- Read approval prompts — check the spender address matches the expected protocol
For Frequent DeFi Users
- Separate hot/cold wallets — cold wallet for storage, hot wallet for DeFi
- Batch revocations when gas is low
- Prefer EIP-2612 permits for modern protocols (single-use)
- Set up alerts for large approval events on your address
- Audit before depositing large amounts — check existing approvals first
Approval Hygiene Checklist
Agent Tips
When helping users with approvals:
- Always warn about unlimited approvals — suggest exact-amount when possible
- Before any large DeFi interaction — suggest checking existing approvals
- After security incidents — immediately recommend revoking approvals to affected protocol
- New users — explain approvals before their first DeFi transaction
- Gas consideration — revocations cost gas, batch them when gas is low
Links
