1

Here's a snippet from the DAI stablecoin permit function:

uint wad = allowed ? uint(-1) : 0;
allowance[holder][spender] = wad;
emit Approval(holder, spender, wad);

(full source code can be found here)

Differently from the EIP-2612 which defines a "value" for the allowance DAI's approach appears to approve an unlimited allowance for the spender address.

Is it safe to permit a protocol to spend DAI on my behalf?

If not, to which use cases is DAI-style permit targeted to?

Improve this question
3
  • 1
    maybe not the answer you look for: but generally "Is it safe to permit a protocol to spend TOKENS on my behalf"? it depends on the protocol. If the protocol is only a smart contract and you see the source code and trust that the contract is bug-free and will only transfer the token based on defined logic and transparent actions/conditions then no harm in doing it (but you can see there is too many "AND"s).
    – Majd TL
    May 16, 2021 at 9:56
  • 1
    it is not erc20 but they use also approve all in their protocol which is similar to unlimited allowance opensea.io/blog/tutorials/…
    – Majd TL
    May 16, 2021 at 9:58
  • @MajdTL Nicely put, there are too many "ANDs" for trusting a protocol with unlimited allowance approval. It's more flexible, sure, but more riskier if any bug is found in the protocol. Thanks!
    – Thomas C. G. de Vilhena
    May 16, 2021 at 12:43

1 Answer 1

Reset to default
1

The recent BADGER protocol exploit, in which US$120 million were stolen, provides more insight to this question.

According to the source:

Infinite approval means unlimited trust - something which we know we shouldn’t do in DeFi.

US$120 million were taken in various forms of wBTC and ERC20 in a front-end attack, in which an unknown party inserted additional approvals to send users' tokens to their own address.

Rumours that the project’s Cloudflare account was compromised have been circulating

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.