I'm trying to call Uniswap V2 addLiquidity function, which calls transferFrom internally, and therefore approve must be called beforehand.

I would like to do it from a TypeScript code. In that case, it calls approve in the first transaction, and then calls addLiquidity in the second transaction. My question is what happens if the second transaction is failed due to some reasons, such as network trouble or insufficient ETH? Is there a risk that the allowance will remain and be exploited?

I found this code is taking the two transactions approach. Maybe not a good approach?

await token1.approve(routerContract.address, amountIn1);
await token2.approve(routerContract.address, amountIn2);

await routerContract.addLiquidity(
      address1, address2, amountIn1, amountIn2, amount1Min, amount2Min, account, deadline

Can I avoid this kind of complication without writing a Solidity code?

2 Answers 2


No risk for it to be exploited since approve function takes your address (i.e. the message sender), and those 2 arguments that you passed in when calling the function (i.e routerContract.address and amountIn1) to mark into the approved ERC20 that the uniswap router can use amountIn1 of your tokens. Not anyone can use it, only the uniswap router.

So you can call the second function one block after calling the approve function, or 1000 blocks after calling it.

There is no reason to fear someone exploiting the Uniswap protocol to somehow exploit your approve of.

  • If I read the uniswap router contract, I would convince that the no one can exploit the allowance. Is there a easy way to convince in general?
    – ywat
    Oct 17, 2022 at 10:28

It is good practice to set the approval back to 0 if a call fail.

Some Defi protocol will require you to set the allowance back to 0 after your call.

  • How does it enforce the requirement? Just by a guideline or some software tool?
    – ywat
    Oct 17, 2022 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.