Token approval (allowance)
Also called: token allowance · approval · approve · spending cap
Definition
A token approval is a permission you sign in your wallet that lets a smart contract spend a set amount of a specific token from your address, often needed before swapping or depositing in DeFi.
How token approval works
On Ethereum and other EVM chains, a contract cannot move your ERC-20 tokens unless you first call approve. The approval names the contract (the spender) and an amount, called the allowance. Many apps request an unlimited allowance so you do not have to approve again for each trade.
Approvals stay active until you change them. If a contract you approved is later hacked or was malicious from the start, it can pull your approved tokens at any time, without another signature from you. Signature-based permits, such as Permit2, can grant similar rights through a message signature that may look harmless.
Good practice: approve only the amount you need when the wallet lets you edit it, read the spender address, and regularly review and revoke old approvals with a revoke tool or the approvals page of a block explorer.
Example
Say you swap 500 USDC on a DEX and approve an unlimited USDC allowance. Months later you hold 6,000 USDC in the same wallet. If that DEX contract were exploited, the attacker could take all 6,000 USDC using your old approval. If you had set the allowance to 500, the contract could not take more than the remaining allowance, which after the swap would be zero.
Common mistakes
- Accepting unlimited approvals by default on apps you use only once.
- Never revoking approvals given to old or abandoned projects.
- Signing a permit message on an unfamiliar site because it does not look like a transaction.
Learn and practise
FAQ
Does revoking an approval cost gas?
Yes. Revoking is an on-chain transaction, so it needs a small network fee on that chain.
Can a token approval steal my ETH?
An ERC-20 approval covers only that token. Native ETH is not moved by approvals, but signing other malicious transactions can still lose it.