1

How exactly do token approvals work? As they cost gas fees, I assume they must be stored on the blockchain.

Let's say, I approve uniswap to spend all my eth. Does that mean that a central entity has access to all ethereum on my address without needing (essentially bypassing) my private key to sign any transactions? Will the blockchain just check for approval in this case, rather than checking whether or not the transaction has been signed with the correct private key? Or is it merely an authorization for any web3 application to prepare a transaction, but it would still need my confirmation?

If no additional confirmation is needed to spend my eth at any time, would that mean that anyone who hacks uniswap for example, would have access to all approved tokens on any wallet that approved them to uniswap?

If I were to approve spending all my eth to a scam website, would only the address that I used to confirm the approval be compromised, or would all addresses associated with my private key be compromised?

If this scamming website would try to steal my coins, would they need me to confirm a transaction for every steal attempt they perform? Or would I at least have to be logged into my wallet (Metamask in my case) for any stealing attempt to be successful?

And what if I use a hardware wallet like trezor. If I approved spending of all my coins to a scamming website and they would attempt to steal it, would they need me to manually confirm something on my wallet? Would they be able to steal even at times when my hardware wallet is not connected?

And lastly, can I manually change the maximum amount of tokens that I approve to be spent (in Metamask for example)? Because often, it is unlimited.

Improve this question

2 Answers 2

Reset to default
2

Yes, setting approval for your tokens lets whoever you approved spend them as if they were there own. So if you allow 1ETH to uniswap then uniswap could spend that 1ETH on your behalf without requiring you to sign any tx or anything of the sort. As for your question about uniswap getting hacked in theory yes, if the hacker obtained access to the address that you approved your tokens to then they could do what uniswap could, which as stated previously is spend your approved amount without any intervention needed from you.

Yes, only the address you approve from would be compromised and only the address you approved could spend the tokens on your behalf.

As soon as you approve your tokens the person you approved no longer needs any form of validation from you, they can spend whatever amount they are approved for. Regardless of the wallet you are using.

Yes you can change the amount you are approving, when you click approve, in metamask you will see "view full transaction details", when you click this it will say how much the user is proposing you allow and allow you to set a custom amount for allowance

p.s you can check who and what you have allowed here https://etherscan.io/tokenapprovalchecker

Improve this answer
3
  • 1
    Wow that's actually a big security concern and noone talks about it. I have read so many crypto tutorials and watched so many YouTube videos about crypto in the last 12 months but the only thing I ever heard is "Don't approve spending tokens to shady websites". Noone ever mentioned that your tokens can be spent at any time. This technically makes every cold wallet a hot wallet again when any unlimited tokens were approved.
    – uzumaki
    Jan 23, 2022 at 16:01
  • There's another question that comes to my mind: What if I approve tokens to a scamming website, but I would later stake them on a trustworthy platform (so they are in a pool and not in my wallet), could the scamming website I approved the tokens to unstake and steal the tokens anyway? Or can they only steal tokens that show up in my wallet and would have to wait in this case?
    – uzumaki
    Jan 23, 2022 at 16:14
  • @uzumaki thats a good question, i would say no, in ERC20 contracts the function you call is a function called transferFrom this function is the exact same as the transfer function however using the address you call transfer with you enter another parameter, address you are sending from. this transferfrom function can only do the same things as transfer does, and you cant transfer things you have staked.
    – nemo
    Jan 24, 2022 at 3:43
0

To add some clarification to the accepted answer: allowances only apply to ERC20/ERC721/ERC1155 tokens, not to ETH. So to swap DAI to ETH on Uniswap you will need to approve an allowance for Uniswap to spend your DAI, but to swap ETH to DAI you don't need any allowances.

I wrote an article on my blog in 2020 that goes into more detail about how allowances work, why they are necessary, and why they may also be dangerous: Unlimited ERC20 allowances considered harmful.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.