← GlossarySecurity
What Is a Token Approval? Why Unlimited Allowances Are Risky
A token approval, or allowance, is permission you give a smart contract or address to spend up to a stated amount of a token from your wallet, using the approve function defined in the ERC-20 standard.
Key takeaways
- ERC-20 separates approving a spender from the transfer itself.
- An approval stays in force until you change it, even if you never use the app again.
- Many apps request an unlimited amount for convenience.
- A malicious or compromised spender can use a standing approval to take the approved tokens.
How approvals work
On Ethereum and similar chains, a token is a smart contract that tracks balances. Tokens following the ERC-20 standard define an approve function, which lets you authorise another address, usually a contract such as an exchange or lending app, to move up to a chosen amount of your tokens. The standard also defines an allowance function to read how much a spender may still use, and a transferFrom function the spender calls to use it.
Why they exist
A decentralised exchange cannot reach into your wallet on its own. You first approve it, and then it can pull the tokens it needs when you trade. This two-step pattern is how many apps work, and it lets a contract move tokens on your behalf without you signing each movement.
Where the risk is
An approval is a standing permission. If you approve an app for an unlimited amount and later that app's contract is exploited, or the spender turns out to be malicious, it can take any of those tokens at any time, even long after you last used it. Many interfaces default to unlimited approvals to save you a repeat transaction later, which is convenient but increases exposure. Scammers also trick users into signing approvals to their own addresses.
Reducing the risk
Approve only the amount you need where the app allows it. Review and revoke old approvals with a tool that lists them, especially for apps you no longer use. Treat an approval request like a payment authorisation: read what it says before confirming, and be wary when an unfamiliar site asks you to approve anything. Keep valuable tokens in a separate wallet from the one you use with new apps.
Example
You approve a swap app to spend 1,000 USDC from your wallet when you only meant to swap 100. Months later the app's contract is exploited. The attacker uses your standing approval to move 1,000 USDC out of your wallet.
Put it into practice
Read every approval request
In Scrypt Wallet you confirm each swap before it is sent. Read what a request authorises and approve only what you need.
Create a free wallet Get Scrypt for AndroidSources and verification
Last reviewed 2026-10-02 by the Scrypt Wallet team. The factual claims on this page, and where each comes from:
- EIP-20 defines approve, which allows a spender to withdraw from your account up to a stated amount. [1]
- EIP-20 defines allowance and transferFrom so a spender can use an approved amount. [1]
- ethereum.org describes ERC-20 as the standard for fungible tokens on Ethereum. [2]
Sources
- EIP-20: Token standard · Ethereum EIPs · primary source
- ERC-20 token standard · ethereum.org · secondary source
Primary sources are protocol papers, specifications, source code or a project's own documentation; secondary sources are wikis and explainers. We checked each claim against the source text on the review date. Found an error? Tell us and we will correct it.
Frequently asked questions
Does approving a token send it?
No. It only gives permission. The spender must then call a transfer to move tokens, up to your allowance.
How do I cancel an approval?
Set the allowance for that spender to zero with a new approval transaction, which costs a small fee.
Is it the same on Solana?
Solana tokens use a similar delegate concept, but wallets and apps handle it differently. Read the request carefully.
Written by the Scrypt Wallet team · Updated 2026-10-02. General education, not financial, tax or legal advice.