What is an ERC-20 token approval?

An ERC-20 approval is a transaction where you grant a smart contract permission to transfer a specific amount of your tokens on your behalf. DeFi protocols use approvals so that you can initiate a token swap: the DEX contract moves your tokens into the pool with your pre-granted permission. The approval persists independently of any subsequent swap.

Why do wallets approve unlimited amounts by default?

Wallet interfaces default to the maximum possible amount (2^256 - 1) because it is convenient: you sign once and then interact with the protocol as many times as you like without re-approving. The downside is that a single exploit on the approved contract can drain your entire token balance. Some modern interfaces now default to exact-amount approvals.

Can I lose money from an old approval I forgot about?

Yes. Approvals do not expire. If you approved an unlimited amount on a DeFi contract two years ago and that contract is exploited today, your current balance of that token can be drained. Security researchers regularly find wallets drained through exploits on protocols the victims had not used in years.

Is revoking approvals safe?

Yes. Revoking an approval is a standard on-chain transaction that sets the approved amount back to zero. It costs a gas fee but poses no risk to your assets. The only consequence is that you will need to re-approve the protocol if you want to use it again.

Do Solana and Tron have the same approval risk?

Solana uses a different model. Instead of approvals, Solana uses token accounts: when you interact with a program, you transfer tokens to a program-controlled account. The primary risks are different: freeze authority (the mint authority can freeze your token account) and malicious programs. Tron's TRC-20 standard does use approvals similar to ERC-20.

What makes an approved contract dangerous?

Three factors: (1) the contract has active upgradeability and its implementation can be changed; (2) ownership is held by a non-renounced EOA wallet rather than a multisig or timelock; (3) the contract has had no meaningful security audit. A contract that was safe when you approved it may not stay safe.

Guide · Token safety

ERC-20 token approval risk
what you're really signing

A token approval is not the same as a swap. It is a standing permission you grant to a smart contract - and unless you revoke it, it stays active forever. Here is what that means and how to manage it.

Check a contract before approving

Free · No sign-up · EVM · Solana · Tron

Every scan is powered by the XemaS Semantic Intelligence Platform · answers carry their evidence and coverage state

The mechanics

How ERC-20 approvals work

The ERC-20 standard has a function called approve(spender, amount). When you call it, you are telling the token contract: "I authorise this address to transfer up to this amount of my tokens." The DEX or DeFi protocol is the spender, and once approved, it can move your tokens without a second confirmation from you.

The amount you approve is not consumed by the swap. After a 100 USDC swap, a wallet with an unlimited approval still has an unlimited approval. The permission does not shrink unless you explicitly set it to a lower value.

This creates a persistent, open-ended exposure. The three scenarios below illustrate the risk gradient.

Risk levels

Approval amount and what it means

Exact amountLow risk

The contract is approved for exactly the amount needed for this transaction. If the contract is later exploited, attackers can drain only the approved amount.

Large fixed amountMedium risk

Approved for more than needed "for convenience". Exposes your wallet to any amount up to the approved figure for as long as the approval exists.

Unlimited (uint256 max)High risk

The contract can transfer your entire token balance at any time. A single exploit or ownership transfer on the approved contract drains your wallet completely.

Attack vectors

How approvals are exploited

Contract exploit after approval

If a DeFi contract is exploited after you have given it unlimited approval, the attacker can drain your full balance of the approved token - long after you stopped using the protocol.

Ownership transfer to a malicious wallet

A contract you approved can be transferred to a new owner who then drains all wallets with outstanding approvals. This has happened with real DeFi protocols; always check that ownership is renounced or behind a timelock.

Upgradeable proxy attack

If the approved contract is an upgradeable proxy, a malicious upgrade can introduce a drain function. Your approval, granted when the original code was clean, now authorises the new malicious implementation.

Approval phishing

A fake website mimics a legitimate DeFi interface and prompts you to sign an approval transaction. The approval looks like a normal swap but grants the attacker's contract unlimited access to your tokens.

Stale approvals accumulate

Every DeFi interaction adds to a list of active approvals. Wallets with years of DeFi history often have hundreds of outstanding approvals to protocols that may no longer be maintained or have been deprecated.

Token approval ≠ swap approval

An approval transaction is not the swap itself. It is a separate permission step that persists indefinitely. Many users sign approvals without understanding that they remain active until explicitly revoked.

Practical steps

How to manage approval risk

Before approving: check the contract

Before signing any approval, verify the contract you are approving: is it audited? Is ownership renounced or time-locked? Is it an upgradeable proxy? A scanner resolves all three in seconds.

Approve only the exact amount needed

Most DEX interfaces offer a custom amount option. Set the approval to exactly the swap amount. Yes, it means an extra approval transaction next time - that is a worthwhile trade-off against unlimited exposure.

Audit your existing approvals

Use a token approval checker (specific to your chain) to view every active approval granted by your wallet. Sort by amount: unlimited approvals to unknown or deprecated contracts are the priority.

Revoke dormant approvals

Revoking an approval is a standard ERC-20 transaction (approve with amount = 0). Each revocation costs a small gas fee. Prioritise unlimited approvals and contracts you no longer use.

Check the approved contract for risk

An approval scanner shows you what you have approved, but not the risk level of what you approved. Cross-check the approved contract address for proxy status, ownership, and known exploits.