When you trade tokens on a DeFi protocol, your wallet typically pops up an approval request with an astronomically large default amount — this is "Unlimited Approval." Many users click confirm without a second thought, unaware of the massive security risk behind it. This article explains the mechanics, dangers, and prevention methods of unlimited approvals.
What Is Unlimited Approval?
In the ERC-20 standard, trading on a DEX requires you to first "approve" the smart contract to use your tokens. Limited approval authorizes only the amount needed for the current transaction. Unlimited approval authorizes the contract to use all of that token in your wallet — set to an astronomically large number (2^256-1).
Most DApps default to unlimited approval to save users from re-approving each transaction. While this saves gas, the security cost is too high.
What Are the Specific Risks?
Risk 1: Contract vulnerabilities — Even top protocols like Uniswap can have bugs. Hackers can use your unlimited approval to drain your tokens.
Risk 2: Malicious projects — Small projects may have backdoors allowing them to transfer your tokens at any time (common in rug pulls).
Risk 3: Contract upgrades — Proxy contracts can have their logic updated. A safe contract today could become malicious after an upgrade.
Risk 4: No expiration — On-chain approvals never expire. An unused DApp from years ago still has valid approval over your tokens.
How to Set Custom Approval Amounts in MetaMask
- When a DApp requests approval, MetaMask shows the approval popup
- Click the edit icon next to "Use default"
- Change the amount to what you actually need
- Confirm and submit
For example, if swapping 200 USDT on Uniswap, set approval to 200 or slightly more (e.g., 250). This costs an extra gas fee for re-approval but the security is worth it.
How to Check and Revoke Existing Approvals
Tools:
- Revoke.cash: Connect wallet to see all approvals, supports multiple chains
- Etherscan Token Approvals: View and manage Ethereum approvals
- DeBank: Check approvals under the Approval tab
Steps to revoke:
- Visit Revoke.cash and connect your wallet
- Filter for "unlimited" approvals
- Assess which are no longer needed
- Click "Revoke" and confirm the transaction
- Pay gas fee
Priority revocations: DApps you no longer use, unknown/suspicious projects, unlimited approvals for high-value tokens.
Alternatives to Unlimited Approval
Permit2 (by Uniswap): Introduces expiration mechanisms and finer control, though it brings new signature security concerns.
EIP-2612 Permit: Off-chain signature-based approval without a separate on-chain transaction, but requires careful verification.
Account Abstraction: Smart contract wallets can build in approval management logic.
Security Tips
- Never blindly accept unlimited approvals — take seconds to edit the amount
- Only approve audited, well-known protocols — Uniswap, Aave, Curve
- Revoke after use — remove approvals for DApps you're done with
- Regular cleanup — check approvals monthly
- Use separate wallets — don't interact with DApps using your high-value wallet
- Monitor security alerts — revoke immediately if an approved project has an incident
Manage your DApp approvals well to protect your assets. Binance offers platform-level security, or download the Binance App (iOS: iOS guide).
What's the difference between unlimited approval and malicious signatures?
Unlimited approval is an on-chain approve transaction that can be revoked. Malicious signatures (like Permit signatures) are off-chain, cost no gas, and are harder to detect or prevent.
Is setting custom amounts every time too troublesome?
It takes a few extra seconds and one extra gas fee. For high-value tokens, this small cost is negligible compared to potential losses. On low-gas chains (BSC, Polygon), the extra cost is nearly zero.
I gave unlimited approval but haven't been hacked — should I still revoke?
Yes. Not being hacked yet doesn't mean you're safe; the risk just hasn't been triggered. Better safe than sorry.
Can hardware wallets prevent unlimited approval risks?
Not fully. Hardware wallets protect your private key from theft, but if you confirm an unlimited approval transaction with a hardware wallet, the approval is on-chain and active. The hardware wallet cannot prevent the contract from moving your tokens within the approved amount.