What a token approval grants, and how to revoke one

A token approval is an on-chain permission, granted by calling a smart contract’s approve() function, that lets another contract move a set amount of a specific token out of your wallet whenever it wants, without asking again. Revoking one sets that allowance back to zero – it stops future use of that permission, but it does not undo a transfer that has already happened. What approve() actually grants Most ERC-20 tokens, the standard used by the large majority of tokens on Ethereum and compatible chains, follow a pattern that gives a smart contract no default access to a wallet’s balance. Before a decentralized exchange, lending protocol or NFT marketplace can move a user’s tokens, the user must call approve() on the token’s own contract, naming a spender address and an amount, according to Blockscout, Coin98, Ledger Academy and MetaMask. Once that transaction confirms, the spender contract can call a second function, transferFrom(), to move up to the approved amount at any time – without a further signature from the wallet owner, per the same sources. MetaMask illustrates the everyday version of this: swapping USDC for ETH on a decentralized exchange requires one transaction to approve the exchange’s contract to spend the USDC, and a second to execute the swap itself. Two details matter, per MetaMask’s account. The approval is specific to one token and one spender – approving a decentralized exchange to spend USDC gives it no access to ETH or any other token in the wallet. And the approval itself is a blockchain transaction that costs a network fee, separate from whatever action prompted it. Limited versus unlimited approvals The amount field in an approval determines the ceiling. A limited approval authorizes a specific quantity – MetaMask’s example is exactly the 500 USDC needed for one swap – and once that amount is used, a fresh approval transaction is required for the next one. An unlimited approval authorizes the maximum possible value a token contract can express, 2^256-1, a number MetaMask notes is far larger than the total supply of any real token. Practically, that means the spender can move the wallet’s entire balance of that token, at any point in the future, with no further approval needed. Most dApps default to requesting unlimited approvals because it removes repeat transaction fees for the user, a tradeoff described by Blockscout, Coin98 and MetaMask alike. The cost of that convenience is that the permission never expires on its own. Blockscout puts it plainly: token approvals do not expire automatically. If the contract that holds an unlimited approval is later exploited, upgraded maliciously, or turns out to have been untrustworthy from the start, an attacker can drain the full approved balance without the victim signing anything at that moment.