1

Here's a snippet from the DAI stablecoin permit function:

uint wad = allowed ? uint(-1) : 0;
allowance[holder][spender] = wad;
emit Approval(holder, spender, wad);

(full source code can be found here)

Differently from the EIP-2612 which defines a "value" for the allowance DAI's approach appears to approve an unlimited allowance for the spender address.

Is it safe to permit a protocol to spend DAI on my behalf?

If not, to which use cases is DAI-style permit targeted to?

3
  • 1
    maybe not the answer you look for: but generally "Is it safe to permit a protocol to spend TOKENS on my behalf"? it depends on the protocol. If the protocol is only a smart contract and you see the source code and trust that the contract is bug-free and will only transfer the token based on defined logic and transparent actions/conditions then no harm in doing it (but you can see there is too many "AND"s).
    – Majd TL
    May 16, 2021 at 9:56
  • 1
    it is not erc20 but they use also approve all in their protocol which is similar to unlimited allowance opensea.io/blog/tutorials/…
    – Majd TL
    May 16, 2021 at 9:58
  • @MajdTL Nicely put, there are too many "ANDs" for trusting a protocol with unlimited allowance approval. It's more flexible, sure, but more riskier if any bug is found in the protocol. Thanks! May 16, 2021 at 12:43

1 Answer 1

1

The recent BADGER protocol exploit, in which US$120 million were stolen, provides more insight to this question.

According to the source:

Infinite approval means unlimited trust - something which we know we shouldn’t do in DeFi.

US$120 million were taken in various forms of wBTC and ERC20 in a front-end attack, in which an unknown party inserted additional approvals to send users' tokens to their own address.

Rumours that the project’s Cloudflare account was compromised have been circulating

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.