What is a token approval (allowance)?
A token approval lets a smart contract move a token from your wallet. Why apps ask for one, why unlimited ones are risky, and how to revoke them.
Updated Nov 8, 2026
In short
A token approval, or allowance, is a permission you give a smart contract to move up to a set amount of a token from your wallet. DeFi apps need one before they can swap or deposit your tokens, and many ask for an unlimited amount. The permission stays until you revoke it, so an old approval to a contract that's later exploited can still drain that token.
Why apps ask for one
On Ethereum and other EVM chains, a contract can't take tokens from your wallet on its own. Before a DEX can swap your USDC, you approve it to move USDC: you set an allowance for that contract. Then the swap can go through.
Apps often ask for an unlimited allowance so you don't have to approve again next time. It's convenient, and it means that contract can move every unit of that token you'll ever hold in that wallet.
Why it matters
- Contracts get exploited. A protocol you used once can be hacked later, and its approvals with it.
- Drainers use them. A fake site asks for an approval that looks routine, then empties the token.
- They're easy to forget. An approval from years ago is as valid as one from today.
What to do
Approve exact amounts when an app lets you. Check your approvals now and then, and revoke ones you don't need, starting with unlimited ones to contracts you don't use or can't verify. Revoking is a small onchain transaction, and your tokens don't move. Step by step: how to find and revoke risky token approvals.
In Burokku
The Approvals tool lists every live allowance across all your wallets and chains, scored for risk, with the value each spender could take today, and revokes them in as few signatures as your wallet allows. A risky approval alert tells you as soon as a wallet grants an unlimited approval to an unverified contract.
Questions
- Do approvals expire?
- Standard token approvals don't. They stay until you revoke them or set them to zero, however long ago you gave them.
- Is signing a message safer than approving?
- Not always. Permit and Permit2 let an app get an allowance from a signature instead of a transaction. It costs no gas, which also makes it easy to give without noticing. Read what you're signing.