What does approving a token on MetaMask actually allow
When you hit "Approve" in MetaMask, you are broadcasting a transaction that calls the approve function on an ERC-20 token contract. The function takes two arguments: the spender address and the amount.
The spender address is the contract you are interacting with - a DEX, a lending protocol, or a marketplace. The amount is the maximum number of tokens that contract is allowed to move from your wallet. Once approved, the spender can call transferFrom on your behalf. It does not need your private key again. You have delegated permission.
That is all the ERC-20 standard guarantees. No expiry. No limit beyond the number you set. No automatic revocation.
What the spender can actually do
The spender can transfer tokens out of your wallet up to the approved limit. It can do this in one transaction or many, immediately or a year later. It can do it even if the protocol's frontend is offline, because the permission lives on-chain.
If you approved 1,000 USDC for a swap and then swapped 100, the remaining 900 is still available to that contract. You might forget that. The contract does not.
On legitimate protocols this is usually fine - until it is not. A protocol can be secure today and exploited tomorrow. A compromised admin key can upgrade the contract to a malicious version, and the old approval still stands. The new contract inherits the permission.
Why unlimited approvals are dangerous
Many dApps request an "unlimited" approval: uint256.max, or 2^256 - 1. This is a UX shortcut. It means you never need to approve again for that token and that spender. But it also means that if the spender contract is ever compromised, the attacker can drain every token of that type from your wallet.
Unlimited approvals are not unique to shady projects. They are standard practice at major DEXs and lending platforms. The risk is not that the protocol is malicious today. The risk is that it becomes malicious later - through a hack, a governance attack, or a malicious upgrade.
How to check and revoke approvals
You do not need to trust a third party. Two tools work without asking for your private key.
Revoke.cash is a dedicated approval manager. You connect your wallet and it reads the approvals your address has granted across multiple chains. It shows each spender, the token, and the approved amount. You can submit a transaction to set that approval to zero. Revoke.cash charges no fee beyond the gas.
Etherscan's token approval checker is built into the block explorer. On any token page, click the "More Info" dropdown and select "Token Approvals." Enter your address. The page lists every spender and the exact approved amount. To revoke, you must call the token contract's approve function with the spender address and amount 0. Etherscan provides a "Revoke" button that prepares that transaction.
Both tools are read-only until you sign a transaction. They cannot steal your tokens.
Permit signatures as a safer alternative
The ERC-20 approve model requires an on-chain transaction for every new permission. That costs gas and leaves permanent state. The ERC-2612 standard introduced permit, an extension that lets you authorize a transfer with an off-chain signature.
With permit, you sign a message specifying the spender, amount, deadline, and a nonce. The protocol submits that signature to the token contract, which validates it and executes the transfer. No separate approval transaction needed. The permission expires when the deadline passes. The nonce prevents replay.
permit is not universally supported. It only works on tokens that implement ERC-2612. Many major tokens do, but not all. You cannot revoke a permit that has not been used yet - there is no on-chain state to clear. The protection comes from the expiry.
The pattern is safer than unlimited approvals because the permission is limited in time. But it still requires trust in the protocol to not front-run your signature or manipulate the deadline.
The one check worth making
Before approving any token, ask what the spender contract actually is. If you are on a DEX, the spender is usually a router contract, not the token itself. If you are on a lending platform, it is the pool contract. Verify the contract address against the protocol's official documentation. Approvals cannot be scoped by function. Once granted, the spender can call transferFrom for any reason. There is no way to approve a single swap. Every approval is open-ended until you explicitly revoke it.
Not financial advice. brooder.tech publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.