To swap an ERC-20 style token, you first send an approval transaction. It gives a contract permission to move your tokens up to some amount. Many apps request an unlimited amount to save you from approving again next time.
Why this is a risk
An approval stays active until you cancel it. If the approved contract is later exploited, or the app turns out to be malicious, it can spend the tokens you approved without asking again. Your balance can be drained even though you never signed a transfer.
Reducing the risk
- Approve exact amounts where the app lets you edit the allowance.
- Read the spender address in the approval prompt. If it is not a contract you recognise, stop.
- Be extra careful with signature requests that look like harmless logins. Some grant spending rights off-chain.
- Use a separate wallet for experiments and unfamiliar sites.
How to review and revoke
- Open a reputable allowance checker for the chain you use, or the one in your wallet or block explorer.
- Connect your address, or paste it for a read-only view.
- Sort by value at risk and by age. Old approvals for sites you no longer use are the first to remove.
- Click revoke and confirm. Revoking is an on-chain transaction, so it costs a small network fee.