How to read a token approval before you sign it

Nearly every loss that people describe as "my wallet got hacked" involves no hack at all. The owner signed something. Usually it was a token approval, and usually the wallet showed it as a row of hex that told them nothing.

An approval is worth understanding properly, because it is the one signature that keeps working after you close the tab.

What an approval actually is

The ERC-20 standard, EIP-20, defines two functions that matter here. transfer moves tokens from you to someone else, once. approve does something different: it records that another address — the spender — may call transferFrom and move your tokens on your behalf.

That permission has no expiry. It persists until you change it, and it works whether or not the site that requested it still exists.

This is not a flaw. It is what makes decentralised exchanges possible: the exchange contract has to be able to take the token you are selling at the moment your trade executes. The problem is that the same mechanism, pointed at a hostile contract, is a standing withdrawal authority.

The three fields to read

Whatever your wallet's interface looks like, an approval carries three pieces of information. Find all three before you sign.

1. Which token. The approval covers one token contract. An approval for USDC does not let the spender touch your ETH or your NFTs. If the dialog names a token you were not expecting to trade, stop.

2. Which spender. This is an address, and it is the part people skip. The site says it is the exchange. The signature says an address. Those are the same thing only if you check.

3. How much. Many interfaces default to the maximum value a uint256 can hold — usually rendered as "Unlimited" or a number beginning 115792089. That is not a formality. It means the spender may move every unit of that token you now hold or ever will.

Checking the spender address

Open a block explorer and paste the spender address in. On Etherscan a contract you can safely interact with will usually show:

• A verified source code tab. Unverified bytecode on a contract asking for unlimited approval is a reason to stop, not a detail.
• A contract name that matches the protocol you think you are using.
• Deployment age and transaction count consistent with a live protocol rather than something created this week.

None of these prove safety. A verified contract can still be malicious, and an old contract can be upgraded. But their absence is a strong signal, and checking takes under a minute.

The question is not "is this contract safe?" It is "do I know what this address is?" If you cannot answer the second, you have no basis for answering the first.

Unlimited or exact?

Unlimited approvals exist because they save gas: approve once, trade many times. Exact approvals cost a transaction each time you trade.

The trade-off is real, and it depends on the balance at risk. A wallet holding a few dollars of a token can reasonably use unlimited approvals to a well-known protocol. A wallet holding meaningful value should not carry an unlimited approval to anything it is not actively using.

A middle path most people miss: approve the amount you are about to trade, not the amount you hold. Most interfaces let you edit the figure, though the control is often hidden behind a small "edit permission" link.

Approvals you already have

Every approval you have ever granted is still there. You can list and revoke them:

• Revoke.cash and Etherscan's own Token Approval Checker both enumerate the approvals on an address.
• Revoking is an on-chain transaction and costs gas. Setting an allowance to zero is the revocation.
• Revoke oldest and largest first, and anything pointing at a protocol you no longer use.

This is worth doing periodically rather than once. An approval granted to a protocol that was reputable in 2022 is still live if that protocol's contracts were later compromised.

The signatures that are not approvals

Two others are worth naming, because they do the same damage through a different route.

Permit (EIP-2612) lets you authorise an allowance with an off-chain signature rather than a transaction. No gas, no pending transaction in your history — and the same standing permission at the end of it. Because it costs nothing and produces no on-chain record until it is used, it is a favourite of drainer sites.

setApprovalForAll is the NFT equivalent, from EIP-721. It is binary rather than an amount: the spender may move every token in that collection you own.

A checklist that fits in your head

1. Is this an approval, a permit, or a transfer? Approvals and permits persist; transfers do not.
2. Which token, which spender, how much.
3. Does the spender address resolve to a verified, named, established contract?
4. Can I set an exact amount instead of unlimited?
5. When did I last review my existing approvals?

None of this requires reading Solidity. It requires reading three fields and one block explorer page, which is a smaller ask than the amount most people are signing away.

What is a token approval, in one sentence?

A token approval is a standing permission recorded on-chain that lets another address move a specific token out of your wallet, up to an amount you set, until you change it. It is not a payment and not a transfer — it is authority, and it survives closing the tab.

How do the three permissions compare?

The right-hand column is why a token approval delivered as a permit is the drainer's preferred instrument: identical authority, no fee, and no trace for you to notice later.

How often should you review them?

Every few months, and after any interaction with a protocol you no longer use. A token approval granted in 2022 to a contract compromised in 2025 is live if the wallet still holds that token.

• Revoke the largest allowances first, then the oldest.
• Prefer exact amounts on any wallet holding meaningful value.
• Keep interaction and storage separate — approvals do not cross between addresses.

More on the mechanics in wallet security, on the addresses themselves in suspicious addresses, and on the signing step in transaction safety. A token approval is the one signature that keeps working after you have stopped paying attention, which is why reviewing them is a habit rather than a task. Ten minutes every few months covers every wallet you have ever used, and it is the cheapest insurance available in self-custody. Read the three fields, check the spender once, and prefer an exact amount over unlimited wherever the interface allows it.