An approval is a standing permission written into a token contract, and it outlives the site that asked for it. The site can close, the domain can change hands, the team can disappear, and the allowance stays active until someone sends a transaction to revoke it. Unlimited allowances are the standard drain vector for exactly this reason: one signature, no expiry, no notification.
What an approval is
On EVM chains, an ERC-20 approval writes an allowance into the token contract: a spender address, an amount, and the account that granted it. Once the transaction confirms, the site is no longer part of the arrangement. The contract will honour the spender’s transfer request whenever it arrives, whether that is tomorrow or in two years.
That is why “I have not used that site in months” is not a mitigation. Abandoned approvals are the ones that get harvested.
Unlimited is the default
Most interfaces pre-fill the maximum value, because a finite allowance means the user has to approve again later. The convenience is real and so is the exposure: an unlimited allowance to a contract that later turns hostile drains the token without a single further signature from you.
The drain usually happens in two steps. A fake mint or claim page gets you to connect and approve, and the attacker waits. Weeks later a transaction sweeps the balance. Nothing on your side changes in between, and nothing warns you.
Permit-style signatures deserve their own line. They are signed off chain, cost no gas, and leave no on chain record until they are used. A revoke sweep will not show them, because there is nothing to show yet.
A monthly review that takes ten minutes
Once a month, open a revoke tool, connect the wallet, and sort by allowance size. Then apply three rules.
Revoke anything unlimited that you do not actively use. Revoke anything whose spender you cannot identify. Revoke everything attached to a site you have not visited this quarter.
Cost is no longer an excuse. A revoke is an ordinary transaction, so it costs what a transaction costs. FeeEdge’s 17 August 2026 sample put an ERC-20 transfer on Ethereum L1 at $2 to $10, which is a real bill for twenty revokes. Ethereum.org’s 1 to 6 October 2026 snapshot put Base at $0.001 to $0.002 and Arbitrum One at $0.004 to $0.005, which makes the same sweep effectively free. If you granted approvals on a cheap chain, clean them there.
Separate the wallet that signs from the wallet that saves
The most effective control is not a tool. It is a second address.
Keep savings behind a key that never connects to a site. Fund a spending wallet with roughly a month of activity, and grant approvals only from that wallet. When a new contract appears, use a fresh address rather than the one that already holds permissions, and let the old one run down.
The friction is small. Exchange withdrawal fees in FeeEdge’s 17 August 2026 sample were about 0.5 to 1 USDT for Solana SPL, about 0.3 USDT for BEP-20 and highest for ERC-20, so topping up a spending wallet is cheap on most routes. The hot wallet sizing question covers how much should sit there.
| Permission type | How it ends | What you see before signing | What to check |
|---|---|---|---|
| Finite ERC-20 allowance | Spent down, or revoked | Amount and spender | Whether the spender is still needed |
| Unlimited allowance | Only by revoking | Spender, amount shown as unlimited | Anything you cannot name |
| Permit signature | Used once, or expires | Rarely rendered clearly | Why a signature needs no gas |
| NFT operator approval | Revoked, or the collection is gone | Operator address | Whether it covers the whole collection |
| Native transfer | Immediate | Amount and address | Full address, middle characters |
What it does not cover
Revoking does not undo damage. A permit already used, or a balance already swept, stays gone. The review is prevention, and it only works on the wallet you actually audit.
Nor does it help with a seed you have exposed. Approvals and key compromise are separate failures: the first is a permission you granted, the second is a secret someone else now has. Only moving the assets addresses the second.
What to do next
Put the review in the calendar for the first weekend of the month, and run it on the wallet that holds the most rather than the one you use most. Ten minutes against an unlimited allowance is the cheapest trade in this column.
Then split the roles. One address for sites, one for savings, and a rule that the savings key never sees a connect dialog. If a contract needs funding, it gets a fresh address and a small balance.
Finally, treat unlimited as a decision rather than a default. If the interface offers a finite amount, use it. Scoped permissions are also where smart accounts are heading, though their limits are real: a policy is only as good as the code enforcing it.
0 comments
No comments yet — ask a question and we will answer it here.