Unit 3 · Level 1 · Self-custody & security
Token approvals: the silent drain
To let a swap site trade your tokens, you first sign an 'approval': a permission slip letting that site's smart contract move a token from your wallet. The catch: approvals don't expire. A site can behave perfectly today and use an old approval to drain your wallet next year. No seed phrase needed; you already gave it the key to that one door.
Free to play. No ads, no token, no account needed to start.
What you get asked
What does a token approval actually do?
An approval moves nothing by itself. It grants future spending power over one token to one contract. That power sits there until it's used or revoked.
A swap site requests approval for 'unlimited' USDC instead of the €50 you're swapping. What's the risk?
Sites request 'unlimited' to save you gas on future swaps. Convenient, but the approval outlives your visit. Approving only the amount you need caps the damage.
Put the steps of a periodic approval clean-up in the right order.
Make this a habit, like clearing old app permissions on your phone. A few cents of gas today beats an empty wallet later.
An approval you granted years ago stays active until you ___ it.
Approvals have no expiry date. Revoking is the only way to take the permission back; forgetting about it changes nothing on-chain.
A mint site pops up a wallet request called 'SetApprovalForAll'. What should you do before clicking confirm?
The words in the confirmation window are the contract's real intentions. Read them like a contract, because they are one. If you don't understand what you're signing, don't sign it. 🐜
The rest of this unit
Scams, approvals, cold storage: become hard to rob.