What is a token approval? (ERC-20 explained)
Plain-English explanation of ERC-20 token approvals: unlimited vs exact allowances, how drain scams use approve, and how to read a wallet permission prompt.
On Ethereum-compatible chains, ERC-20 tokens do not move themselves when you click “swap” or “deposit.” First, many apps ask your wallet to approve a spender contract so it may later pull a limited (or unlimited) amount of that token. Public ethereum.org and MetaMask education pages treat approvals as a core permission beginners must understand—not as a buy/sell signal.
What an approval actually is
An approval is a transaction (or, with permit-style flows, a signature) that sets an allowance: “spender address X may transfer up to amount Y of token Z from my address.” After that, the spender can call transferFrom without asking you again until the allowance is used up or revoked. You are not “sending” the tokens in that moment; you are granting a standing permission.
Unlimited vs exact allowance
- Exact / limited approval — You allow only the amount needed for this action (for example, the swap size). Extra interactions may require a new approval later. More friction, smaller blast radius.
- Unlimited approval — Many UIs default to “max” or a huge number so you never re-approve. Convenient—and dangerous if the spender is malicious, compromised, or a phishing clone. One bad allowance can empty that token balance later without another user-facing “send.”
Wallet and revoke-tool educators repeatedly note: unlimited approvals are a common path in “drain” incidents after someone signed on a fake site.
How people get drained
- You visit a lookalike site (ad, Discord link, typo domain).
- The site asks you to “connect,” then “approve” a token for a hostile spender.
- You confirm in the wallet without reading spender address, token, or amount.
- Later (seconds or days), the spender pulls the allowance. Your seed was never stolen—the permission you signed was enough.
Related pattern: setApprovalForAll on NFTs (ERC-721/1155), which can authorize an operator for an entire collection. Same literacy rule: know what you are authorizing.
How to read an approval prompt
- Which site / dapp origin is requesting it? Does it match a bookmark you created from the official URL?
- Which token and which spender contract? Compare the spender to a known router/contract from an official source on an explorer—not from the page that just asked you to sign.
- Allowance size — Unlimited / “max” vs a number that matches what you intend to do.
- Network — Wrong chain or lookalike token contract is a red flag.
If any field is unclear, reject and research offline. Urgency (“approve in 60 seconds or lose access”) is a classic social-engineering tell, also stressed in general phishing guidance from public cyber agencies.
Related free docs & literacy pack
- Common crypto scams to recognize
- How to read a wallet prompt
- Wallet basics: hot, cold, and custodial
- Token approval & revoke literacy pack (teaser) — soft overview of the pack; no payment link on this page
Sources
- ethereum.org — ERC-20 token standard
- ethereum.org — Security and scam prevention
- MetaMask Support — Token approvals explained (vendor education; not an endorsement)
- Ledger Support — What are token approvals? (vendor education; not an endorsement)
- CISA — Phishing guidance (general: verify destinations before granting access)
Educational content only — not investment advice. This page explains permissions and abuse patterns; it does not recommend any token, protocol, or trade.