Token approvals: the permission you forgot you gave
Every swap and vault asks for spending permission first. What unlimited approvals risk, and the revocation habit that contains it.
暂无该语言版本——显示英文。
Why apps ask before they act
Smart contracts cannot move your tokens on their own — you must first approve a spending allowance. The first interaction with any DEX, bridge, or vault is therefore two steps: approve, then act. That approval persists until revoked or spent.
Unlimited approvals are the danger
Many apps request unlimited allowances for convenience, so you never approve twice. The tradeoff: a compromised or malicious contract can drain the full approved balance, not just the amount of your last trade. Convenience compounds into exposure across every app you ever touched.
The hygiene routine
Approve exact amounts where the app allows it. Periodically review allowances on a block explorer's approval checker and revoke what you no longer use — especially unlimited grants to apps you tried once. Treat approvals like open tabs: close them or they accumulate into an attack surface.
Signatures deserve the same suspicion
Offchain signatures (gasless listings, login messages) cost nothing but can authorize plenty. Read every signature request: know whether it moves funds, grants permission, or merely proves address ownership — and reject anything you did not initiate.
Risk note: cryptocurrency trading, leveraged perpetual futures, and automated algorithmic strategies carry significant risk of rapid and total financial loss. Never risk funds you cannot afford to lose completely. Nothing in this lesson is investment advice, a recommendation, or an offer to sell any product.
清单
- I know which approvals my wallets have granted
- I revoke unlimited approvals I no longer use