How to Check a Token Approval Before You Sign It: Allowances, Unlimited Permissions and the Revoke Routine

The permission you grant without noticing
The most expensive beginner mistake in crypto is not clicking a phishing link or losing a seed phrase. It is signing a real transaction on a real website that requested permissions you did not understand. The mechanism is called a token approval, or allowance, and it is a standard, legitimate feature of how tokens work — which is exactly why attackers imitate it. ERC-20 tokens do not move the way ETH does: a contract cannot simply take your USDC. You have to permit it first. You call approve(), naming a spender contract and an amount, and that writes a permission into the token contract: this address may move up to X of my tokens. The spender later calls transferFrom(), pulling tokens up to that limit, whenever it likes, with no further confirmation from you. Wallet drainers took $83.85 million from 106,106 victims in 2025 alone, and among incidents exceeding $1 million, 38 percent involved Permit-style approvals. The attack does not need your seed phrase, your private key, or a broken piece of cryptography. You approve it. That is the entire attack.

What an approval really grants
An approval is not a one-time consent for the swap you were doing. It is a standing authorisation that persists until you actively remove it. If you approved a contract to spend unlimited USDC in 2022, that approval is still active today unless you explicitly revoked it. Worse, the permission attaches to your address, not your current balance: top up the token next month and the old allowance covers the new coins too. Approvals on one token never extend to other tokens, but drainer sites typically collect approvals on several at once, so a single bad session can expose your whole portfolio token by token. The newer signature-only variants make this quieter still: EIP-2612 permit and Uniswap's Permit2 let you authorise a spender by signing an off-chain message instead of sending a transaction — no gas, no confirmation screen showing a token contract, no pending transaction in your history. Your wallet may show what appears to be an ordinary "sign this message" or "verify your wallet" request, and then the attacker calls transferFrom() and your tokens leave. The only thing you did was sign something.

The 30-second check before every signature
Before you sign any wallet request, run four checks. One: asset — which token or NFT is being approved, and is it the one you intended? Two: spender — which contract address is receiving the permission, and does it match the official project's documentation? Three: allowance — is the amount exact for this transaction, or unlimited? Unlimited approvals are convenient for repeat swaps, but they maximise damage if the spender turns malicious, so for wallets holding meaningful balances, prefer exact amounts and re-approve when needed. Four: action — does the wallet's transaction preview match what the site says you are doing? If the site says "claim a reward" and the prompt says "approve unlimited spending", reject it. If a signature request is vague, or asks you to sign typed data you cannot read, reject it too: a legitimate site can explain what it wants, in words you understand, before you sign. If any answer feels wrong, rejecting costs nothing. Approving wrongly can cost everything in that token.

The revoke routine: every 90 days, and after every scare
Approvals do not expire, so they need a routine. Every 90 days, open a revocation tool — Revoke.cash, the most widely used free and open-source platform covering over 100 EVM networks, or Etherscan's Token Approval Checker, or your wallet's own approval view — and enter your wallet address. You can review in read-only mode first, without connecting a wallet, which avoids the irony of connecting to a phishing clone of a revocation tool: type the tool's address by hand or use a bookmark. Sort from newest to oldest and look for three red flags: unlimited approvals to contracts you no longer use, approvals to contracts you do not recognise, and approvals older than one year. Revoke those. Each revocation is an on-chain transaction costing gas — usually $3 to $15 on Ethereum, under $1 on layer-2 networks — but it removes a permission a malicious actor could exploit. Do the same audit immediately after any suspicious prompt, after news of an exploit in a protocol you have touched, and after any session with a site you have soured on. On Solana, the equivalent is a delegate on a token account: routine Solana swaps generally do not require standing delegates, so an unfamiliar delegate deserves immediate suspicion rather than a shrug.

If you already signed something you should not have
Act fast, in this order. First, revoke the approval immediately through a trusted approval tool — speed matters more than gas cost. Second, if you cannot revoke quickly because of high gas fees or congestion, transfer the approved token out of the wallet to a clean wallet that has never interacted with the malicious contract; the attacker's contract has permission to spend tokens from your compromised wallet, but none over a different wallet. Third, save the transaction hashes, approved spender addresses, malicious URLs and screenshots for any report. Fourth, if your seed phrase or private key was entered anywhere, revoking approvals is not enough: move all remaining assets to a new wallet created from a clean setup, because a compromised key bypasses every approval control. And if assets already moved, do not send more gas to a wallet that appears to be drained by a sweeper bot — you would be funding the drain. The uncomfortable truth behind all of this is simple: in crypto, a signature is a legal instrument. Read it like one, every time, and your wallet will survive the scams that empty the wallets of people who signed first and read later.

FAQ
What is a token approval? A standing permission, written into a token contract, allowing a named spender contract to move up to a set amount of your tokens without asking again.
Do approvals expire? No — an approval stays active until you explicitly revoke it, and it covers tokens you acquire later, not just your balance at signing time.
What is an unlimited approval? Permission for a spender to move any amount of a token; convenient for repeat swaps, but it maximises damage if the spender is malicious.
What is a Permit signature? An off-chain signature (EIP-2612 or Permit2) that authorises a spender without an on-chain transaction, so it may leave no trace in your transaction history.
How often should I audit approvals? Every 90 days, plus immediately after any suspicious prompt or exploit news, using Revoke.cash, Etherscan's checker, or your wallet's approval view.
What do I do after a bad approval? Revoke it immediately; if you cannot, move the approved token to a clean wallet; if your seed phrase leaked, move everything to a new wallet.

Read more on Zimbuck: https://zimbuck.com/pages/zimbucknews and join the discussion at https://zimbuck.com/groups/zimbuckmarketnews . Related reading on the site: the fake-crypto-website guide in the Crypto Security category.

This article is market news and general information only, not financial advice.