Token approval

A token approval is a permission recorded on-chain that lets a smart contract spend or move a token from your wallet on your behalf, up to the amount or items the approval covers. The ERC-20 standard builds it in: approve() lets a third-party account spend an amount of a token, allowance() reports how much it may still spend, and contracts collect deposits with transferFrom(). Revoke.cash notes that exchanges, lending apps and NFT marketplaces all rely on approvals, and that most marketplaces use unlimited NFT approvals through setApprovalForAll(), which covers every item in a collection.

An approved contract can spend the approved tokens at any time, and approvals stay active indefinitely unless revoked, so one granted on a fake claim page, or to a project that is later hacked, remains a risk. Revoke.cash cites the SushiSwap exploit of April 2023 as a case where approvals to a hacked contract exposed users' tokens. Reviewing and revoking old approvals limits the damage; see wallet drainer and airdrop scams.