KoinlyticsEvery time you swap on Uniswap, deposit into Aave, or bridge assets, you grant a smart contract permission to move your tokens. That permission is called an approval, and it stays on-chain until you explicitly revoke it. Most wallets set it to "unlimited" by default.
What an approval is
An ERC-20 approve(spender, amount) call. The token contract remembers that spender can spend up to amount of your tokens on your behalf. The DeFi contract can then call transferFrom(you, ..., amount) without a new signature from you.
Why unlimited approvals exist
Gas efficiency. If you approve a fixed amount every time, you pay approval gas twice per interaction. Unlimited approval lets you interact with a protocol repeatedly with a single approval. The trade-off: if that protocol is exploited later, all your tokens are drained even if you last used it years ago.
Historical exploits that used stale approvals
- Multichain (Anyswap). 2023. Users still had approvals to Multichain routers. When keys were compromised, drainer bots emptied wallets.
- Various NFT marketplace exploits. Old approvals to compromised marketplace contracts.
- Bogus airdrop drainers. Users approve an unknown token; the token contract has a hidden
transferFromthat steals the approved amount of ETH the user later interacts with.
How to audit
- Revoke.cash. Free UI. Connect wallet, see all approvals per chain, revoke with one tx per revocation.
- Etherscan Token Approval Checker. Same data, per contract.
- Rabby Wallet. Shows approval risk before every signature.
Best practice for regular users
- Quarterly, run revoke.cash on your main wallet. Revoke everything you have not used in the last 90 days.
- For high-value wallets: set exact-amount approvals when possible. Not free but not that expensive.
- Never approve tokens from unknown sources.
- Use a separate wallet for degen activity. Contain the blast radius.