Infinite Approval

An infinite approval, also called an unlimited approval, is a permission a user gives to a smart contract to move any amount of a particular token from their wallet, with no upper limit and no expiry. It is set through the "approve" function found in the ERC-20 token standard and similar standards on other networks. Decentralized applications often request it so that users do not have to sign and pay for a new approval every time they trade or deposit.

The convenience comes with a lasting risk. If the approved contract has a bug, is upgraded maliciously or is impersonated by a fake website, the permission can be used to drain the user's tokens at any time, even months later. Infinite approvals have played a part in many thefts in decentralized finance, and security guides now routinely advise users to limit and review them.

Imagine signing a direct debit form for a gym that says "the gym may take any amount from my account, at any time, until I cancel". It saves filling in a new form each month. But if the gym is taken over by crooks, or someone copies its paperwork, they could empty the account, and the bank would treat each withdrawal as authorized.

An infinite approval is that kind of open-ended permission for crypto tokens. It is not the same as sending tokens: nothing moves when it is signed. The danger is what the permission allows later. Cancelling it, called revoking, is like tearing up the form.

Ethereum-style tokens are held in a contract that records balances. To let an application, such as a decentralized exchange, move tokens on a user's behalf, the user signs an approval naming the application's contract (the "spender") and an allowance. When the user later trades, the application's contract calls the token's transfer function, which checks and reduces the allowance.

An "infinite" approval sets the allowance to the largest number the contract can store, a figure with 78 digits, which in practice never runs out. A limited approval sets the allowance to the exact amount needed. Approvals stay in force until the user changes them, even if the user stops using the application, and each one is a public record that anyone can inspect.

• Fewer transactions. Each approval is a separate transaction with its own gas fee, so an unlimited approval saves money for frequent users.
• Smoother use. Users can trade or deposit repeatedly without extra confirmation steps.
• Default settings. Many interfaces pre-select unlimited approvals, and users often accept them without reading.
• Composability. Some protocols route a trade through several contracts in one transaction, and a standing allowance avoids having to predict the exact amount each step will need.

Approval risk takes several forms. A protocol's contract may contain a flaw that lets an attacker call transfer functions using other people's allowances; several DeFi exploits have worked this way. Attackers also build fake websites or compromise real ones to ask for approvals to contracts they control. In December 2021, malicious code injected into the website of BadgerDAO prompted users to grant approvals that were later used to take about 120 million dollars in tokens. Approvals granted years earlier to protocols that were later abandoned or exploited have also been used to take funds from users who had long forgotten about them. Wallet-draining kits sold to criminals automate this kind of phishing, sometimes using signature-based approvals that do not even require an on-chain transaction.

• Approve only what is needed. Many wallets let users edit the amount before signing.
• Review and revoke. Token approval checkers, including tools built into some blockchain explorers, list active approvals and let users revoke them.
• Check what is being signed. Wallets that show human-readable transactions make it clearer when a request grants spending rights.
• Separate wallets. Keeping most funds in a wallet that never grants approvals, such as a hardware wallet used only for storage, limits the damage of a bad approval.

Newer designs aim to reduce the problem at its source. Signature-based approvals can include an expiry time, and shared approval contracts let users grant time-limited, amount-limited permissions that apply across applications. Smart-contract wallets based on account abstraction can bundle an approval and its use into a single step, so no standing permission remains afterwards.