Token Approval

A token approval is an on-chain permission you grant a smart contract to spend a specific token from your wallet, up to a chosen amount. The mechanism comes from the ERC-20 token standard: contracts cannot simply take your tokens, so protocols like decentralized exchanges first ask you to approve their contract as a spender, and only then can a swap or deposit move the tokens.

For example, before swapping USDC on a DEX for the first time, your wallet prompts you with an approval transaction naming the DEX router as spender. Many apps request unlimited approval by default so you never have to approve that token again, which is convenient but means the contract can move any amount of that token from your address indefinitely. NFTs have an equivalent permission that can cover an entire collection at once.

Approvals persist until explicitly revoked, and they are the raw material of approval exploits: malicious sites harvest them, and hacked protocols expose everyone who granted them. Good hygiene is to prefer exact-amount approvals when your wallet offers the option, and to review and revoke stale permissions occasionally using a reputable approval-management tool. A common misconception is that disconnecting your wallet from a website cancels its approvals; disconnection only stops the site from seeing your address, while the on-chain permission remains until you send a revoke transaction.