How Token Approvals Work on Ethereum: A Security Guide

A token approval is a permission you grant to a smart contract, allowing it to move a specified amount of a token from your wallet on your behalf, without needing your signature for each individual transfer. This "approve and allowance" mechanism underlies nearly every interaction with decentralized exchanges, lending platforms, and other /defi applications, but it's also one of the most common sources of unexpected fund loss when approvals are left overly broad or unrevoked.

Why approvals exist

Most tokens on Ethereum follow a standard interface that includes an approve function, letting a token holder authorize a specific other address — typically a protocol's smart contract — to transfer up to a set amount of that token from the holder's balance. This exists because a contract can't otherwise reach into your wallet and take tokens on its own initiative; you must first explicitly grant it permission. Once approved, the protocol's contract can call a transferFrom function to move tokens within the approved limit, whenever the logic of whatever action you're taking (like a swap or a deposit into a lending pool) requires it.

The unlimited approval problem

To avoid asking users to approve a fresh, exact amount every single time they interact with a protocol — which would mean paying /glossary/gas for an approval transaction before every deposit or swap — many applications, by default, request approval for an extremely large or effectively unlimited amount. This is convenient: you approve once, and every future interaction with that contract skips the extra approval step. The tradeoff is that this same unlimited approval remains active indefinitely unless you manually revoke it, meaning if that contract is later found to contain a vulnerability (see /blog/common-smart-contract-vulnerabilities) or if its upgrade authority is compromised, in the case of an upgradeable contract like those in /blog/what-is-proxy-contract-upgradeable, an attacker could potentially drain any tokens still covered by that lingering approval.

Approval-based scams

A specific and common scam pattern, covered generally in /blog/common-defi-scams, involves tricking users into signing a token approval for a malicious contract disguised as a legitimate action — for example, a fake token claim or airdrop page that actually requests an unlimited approval rather than performing the advertised action. Because the approval transaction itself doesn't immediately move any tokens, victims often don't notice anything wrong until the attacker later uses the approval to drain the approved tokens at a time of their choosing.

Comparing approval types

Approval type	Convenience	Risk if the approved contract is compromised
Unlimited approval	High — no repeated approval transactions needed	High — full token balance exposed indefinitely
Exact-amount approval	Lower — a new approval needed for each larger action	Lower — only the specifically approved amount is exposed
Time-limited or revoked promptly	Moderate	Low — exposure window is minimized

Reading an approval before signing it

Because an approval transaction's input data specifies both the spender address and the amount, it's possible to review these details before signing using your wallet's transaction preview, or by understanding the transaction structure via a contract's /blog/what-is-an-abi-ethereum. Checking that the requested amount and spender address genuinely match what you expect — rather than blindly approving whatever a popup requests — is a meaningful defense against approval-based scams.

Approvals versus a direct transfer permission model

It's worth understanding why Ethereum's token standard uses this two-step approve-then-transfer model rather than simply letting a protocol move tokens directly whenever needed. Requiring an explicit, visible approval transaction before any third-party transfer is possible gives users a clear, auditable moment of consent — without it, there would be no way to distinguish a legitimate protocol interaction from an unauthorized transfer, since both would look identical at the transfer step itself. The approval step is, in effect, the entire security boundary of the system: everything downstream depends on that initial grant being made deliberately and scoped appropriately.

Managing existing approvals

Approvals don't expire on their own; they remain active until either fully consumed through transfers or explicitly revoked by the token holder. Practical steps for managing this exposure are covered in /blog/how-to-revoke-token-approvals, which walks through using approval-checking tools to review and clean up old, unnecessary permissions.

Newer approval standards aimed at reducing this risk

Recognizing the risks of the original unlimited-approval pattern, newer token and signature standards have introduced alternatives such as time-limited or single-use permission signatures that don't require a separate on-chain approval transaction at all, reducing both the gas overhead and the lingering exposure window of a traditional approval. Adoption of these newer patterns varies across the ecosystem, and many widely used tokens and protocols still rely on the traditional approve-and-allowance model described above, meaning the practices covered in /blog/how-to-revoke-token-approvals remain broadly relevant for the foreseeable future.

Bottom line

Token approvals are what allow DeFi protocols to move tokens on your behalf without a signature for every single transaction, but unlimited approvals — while convenient — leave your funds exposed indefinitely to any future compromise of the approved contract. Periodically reviewing and revoking unused approvals, and scrutinizing the spender and amount before signing a new one, are basic but important habits for anyone regularly using /defi applications.