Crypto Gloss

Token Approval Exploit

Definition:

A token approval exploit occurs when a user signs an approve() transaction granting an ERC-20 allowance — often unlimited — to a malicious or later-compromised smart contract, which can then call transferFrom() to withdraw all approved tokens from the user’s wallet. The approval itself is on-chain and permanent until revoked. Most users never monitor existing approvals, leaving millions of dollars perpetually at risk from past interactions with exploited protocols.

How ERC-20 Approvals Work

The ERC-20 standard requires a two-step process for contract-initiated token transfers:

  1. approve(spender, amount): The user grants a contract address (spender) permission to move up to amount tokens on their behalf. Called once.
  2. transferFrom(from, to, amount): The approved contract can call this at any time to move tokens from the user’s wallet to any address, up to the approved amount.

Most DeFi interfaces default to type(uint256).max — effectively unlimited — for the amount parameter, so users don’t need to approve again on repeat interactions. This UX compromise creates persistent risk.

Attack Vectors

1. Unlimited Approval + Later Exploit

A user approves a legitimate DeFi protocol (e.g., a DEX, lending platform). The protocol is later exploited or has a bug. The attacker’s exploit contract calls transferFrom() using the victim’s existing unlimited approval to drain their wallet — without the user signing anything new.

Examples:

  • Bancor exploits: Approvals granted to old Bancor contracts remained valid after vulnerabilities were discovered, putting user funds at risk.
  • Various AMM exploits: Users who had approved liquidity routers lost funds when router upgrade bugs were exploited.

2. Phishing + Immediate Drain

A user is sent to a phishing site and tricked into approving a malicious contract. The attacker immediately drains all approved tokens via transferFrom().

3. Permit Signature Attack (gasless)

EIP-2612-compliant tokens (ERC-20 with permit) allow approvals via off-chain signatures — no gas cost, no on-chain transaction. An attacker presents a fake signing request. The user signs what appears to be a harmless message; the attacker submits the permit on-chain, instantly gaining unlimited allowance.

Scale of the Problem

Studies of Ethereum mainnet data consistently show hundreds of thousands of wallets with active unlimited approvals to contracts that have since been deprecated, upgraded, or exploited. A 2023 analysis by Revoke.cash found the average DeFi user has 15–30 active approvals, the majority unlimited.

Prevention

For users:

  • Revoke unused approvals: Use Revoke.cash, Etherscan Token Approvals, or Rabby wallet’s built-in approval manager regularly.
  • Set exact amounts: When approving, manually enter the exact amount you intend to use rather than accepting unlimited.
  • Use hardware wallets: Physical confirmation of every approval is required, reducing accidental approvals.
  • Read signing prompts carefully: Pay attention to the contract address and approval amount before confirming.

For protocols:

  • Approval warnings: DeFi interfaces should display existing approval amounts and warn before requesting unlimited approvals.
  • Upgrade-aware contracts: Proxy patterns should invalidate old approvals upon upgrades when the contract’s behavior changes materially.
  • Emergency revoke mechanisms: Some protocols now build emergency pause functions that also revoke outstanding approvals.

Related Terms

Sources

Last updated: 2026-04