An approval drain is a security exploit that leverages a user's existing, often excessive or forgotten, token approval on a blockchain like Ethereum. When a user interacts with a decentralized application (dApp), they must grant a spend approval for the dApp's smart contract to move specific tokens on their behalf. If this approval is set to an unlimited amount or a very high value, a malicious actor who gains control of that contract can drain the approved tokens from the user's wallet long after the initial interaction. This attack does not require stealing the user's private keys, only exploiting a legitimate but risky permission.
LABS
Glossary
Approval Drain
An approval drain is a security exploit where an attacker uses a previously granted, excessive token allowance to withdraw funds from a user's wallet without their current consent.
Chainscore © 2026
definition
SECURITY VULNERABILITY
What is Approval Drain?
An approval drain is a type of blockchain exploit where an attacker uses a previously granted token approval to withdraw assets from a victim's wallet without their current consent.
The vulnerability typically stems from over-permissioning. Many dApps request unlimited approvals for user convenience, eliminating the need for repeated transactions. However, if the dApp's smart contract is later compromised through a hack, contains malicious code, or its admin keys are stolen, the attacker can use the contract's pre-existing approvals to siphon funds from all users who granted it access. This makes contract security and principle of least privilege—granting only the minimum necessary allowance—critical for user safety. Tools like token approval revokers are essential for monitoring and managing these permissions.
To mitigate approval drain risks, users should regularly audit and revoke unnecessary approvals using blockchain explorers or dedicated security dashboards. Developers can implement safer patterns, such as requesting allowances for exact amounts or using permit signatures (EIP-2612) for single-transaction approvals that don't persist. The rise of ERC-7579 (Minimal Approvals) aims to standardize this safer approach. Prominent examples include the 2022 Wintermute hack, where an old, compromised DeFi contract was used to drain millions from a vanity address, highlighting the persistent danger of stale permissions in a user's transaction history.
how-it-works
SECURITY THREAT
How an Approval Drain Works
An approval drain is a type of smart contract exploit where an attacker uses a previously granted token approval to transfer a victim's assets without their current knowledge or consent.
An approval drain is a security exploit that leverages the ERC-20 or ERC-721 token approval mechanism. When a user interacts with a decentralized application (dApp), they often sign a transaction granting the dApp's smart contract permission to spend a specific amount of their tokens. This approval is stored on the blockchain. If the dApp's contract is malicious, or if the user inadvertently grants an excessive or infinite approval to a compromised contract, an attacker can later call the contract's transferFrom function to drain the approved tokens from the user's wallet. The victim may have no idea the attack is happening until their funds are gone.
The attack vector typically begins with a user signing a seemingly legitimate transaction, such as swapping tokens on a new decentralized exchange or minting an NFT. The malicious contract, however, is designed with a hidden function or a logic flaw that allows an external address—controlled by the attacker—to trigger the transfer. Unlike a direct wallet hack, the attacker does not need the victim's private key; they only need the on-chain approval and the ability to interact with the vulnerable contract. This makes phishing sites and fake dApp frontends common delivery mechanisms for these scams, as they trick users into signing the malicious approval transaction.
To mitigate approval drain risks, users should regularly audit and revoke unnecessary token approvals using tools like Etherscan's Token Approvals checker or dedicated revocation services. Developers can implement safeguards such as using the ERC-20 increaseAllowance and decreaseAllowance functions instead of approve, which help prevent certain race condition attacks, and designing contracts to request only the exact amount needed for a transaction. For maximum security, a proxy contract or meta-transaction pattern can be used, where users sign messages instead of direct approvals, allowing for more granular and revocable permissions without persistent on-chain allowances.
key-features
SECURITY THREAT
Key Characteristics of Approval Drains
Approval drains are a sophisticated form of token theft that exploits standard ERC-20 and ERC-721 smart contract permissions. Understanding their defining features is critical for wallet security.
01
Exploits Standard Permissions
An approval drain does not hack a smart contract. It abuses the legitimate ERC-20 approve() or ERC-721 setApprovalForAll() functions that users sign to grant spending access. The attacker creates a malicious contract that calls these pre-approved allowances to transfer assets.
02
Requires Prior User Signature
The attack is only possible after a user signs a malicious transaction. This often occurs through:
- Signing a malicious permit (EIP-2612) or increaseAllowance call.
- Interacting with a spoofed dApp frontend.
- Approving a seemingly legitimate NFT collection or token swap. The signature grants the attacker's contract the right to move funds at a later time.
03
Asynchronous & Stealthy Execution
The drain can be executed long after the initial approval is granted. This creates a persistent backdoor. The malicious transfer often occurs in a separate, unrelated transaction, making it difficult for users to connect the drain to the original approval event.
04
Targets Specific Token Allowances
Unlike a private key compromise, a drain is selective. It can only withdraw tokens for which the user has granted an allowance to the attacker's contract address. Common targets include high-value stablecoins (USDC, USDT) and blue-chip NFTs, as approvals for these are often set to unlimited amounts.
05
Uses Social Engineering & Spoofing
The primary vector is user deception, not technical exploits. Attackers use:
- Fake dApp websites that mimic legitimate services.
- Malicious embedded signatures in NFT minting or airdrop claims.
- Transaction simulation blindness, where wallet UIs fail to show the true effect of a
permitsignature.
visual-explainer
EXPLAINER
The Attack Flow
An approval drain is a sophisticated form of cryptocurrency theft where an attacker exploits a user's prior token approval to transfer assets without further consent. This attack vector targets the fundamental `approve` and `transferFrom` functions of token standards like ERC-20 and ERC-721, turning a legitimate delegation of spending power into a financial drain.
The attack flow begins with a seemingly innocuous on-chain transaction. A user interacts with a dApp, such as a decentralized exchange or NFT marketplace, and signs a transaction to approve the dApp's smart contract to spend a specific amount of their tokens. This approval is a standard requirement for the dApp to function, allowing it to execute trades or transfers on the user's behalf. However, if the dApp is malicious or becomes compromised, the attacker can now exploit this pre-existing approval.
Once the approval is in place, the attacker initiates the drain phase. They call the transferFrom function on the token contract, specifying the victim's address as the source and their own address as the destination. Because the victim's prior approval authorized the dApp's contract address, this transfer executes without requiring any further signature or action from the victim. The assets are moved directly from the victim's wallet to the attacker's control, often in a single, irreversible transaction.
Several factors enable this attack. A common vulnerability is an infinite or excessive approval, where a user grants permission for an unlimited amount of tokens, often for convenience. Other risks include approvals to malicious or hijacked contracts and signature phishing (e.g., permit signatures for ERC-20). The attack is stealthy because it doesn't rely on stealing private keys; it abuses a legitimate, on-chain permission that the user has already granted, making it difficult to detect until the funds are gone.
To mitigate approval drain risks, users should practice approval hygiene: regularly reviewing and revoking unused approvals via tools like Etherscan's Token Approvals checker, setting spending limits instead of infinite approvals, and being extremely cautious about signing any transaction that grants token permissions. For developers, implementing safeguards like time-limited approvals or using more secure delegation patterns can reduce the attack surface for their users.
security-considerations
APPROVAL DRAIN
Security Risks & Attack Vectors
An approval drain is a type of wallet exploit where a malicious smart contract uses a previously granted token allowance to transfer assets without the user's current consent. It is the most common vector for cryptocurrency theft.
01
Core Mechanism: The ERC-20 Allowance
The attack exploits the ERC-20 approve() and transferFrom() functions. When a user interacts with a DApp, they often sign a transaction granting it an allowance (spending limit) for a specific token. A malicious contract can later call transferFrom() to move tokens up to that approved amount, even if the user is no longer actively using the DApp.
- Key Functions:
approve(spender, amount),transferFrom(from, to, amount). - Persistent Permission: The allowance remains valid until explicitly revoked or exhausted.
02
Infinite vs. Limited Approvals
The risk severity is defined by the allowance amount granted.
- Infinite Approval: Granting
type(uint256).max(essentially unlimited) is common for UX convenience but poses maximum risk. A single compromised protocol can drain the entire token balance. - Limited Approval: Setting a specific, needed amount caps potential loss but requires frequent re-approvals.
- Best Practice: Use permit signatures (EIP-2612) for single-use allowances or regularly revoke unused approvals.
03
Common Attack Vectors & Lures
Attackers use social engineering to trick users into granting approvals.
- Malicious Airdrops: Fake tokens sent to wallets; interacting with them triggers an approval to a malicious contract.
- Spoofed DApp Frontends: Phishing sites mimicking legitimate protocols (Uniswap, Compound) to capture approvals.
- Rug Pulls: Initially legitimate projects that later turn malicious, using their existing approvals.
- Malicious NFTs: NFTs with hidden
onERC721Receivedfunctions that trigger unwanted approvals.
04
Real-World Example: Inferno Drainer
Inferno Drainer was a widespread phishing-as-a-service kit responsible for over $80 million in stolen crypto in 2023. It automated the creation of fake websites that tricked users into signing transactions granting excessive token approvals. The kit included:
- Pre-built templates for popular protocols.
- Automated fund forwarding to the attacker.
- A dashboard for affiliates to track stolen funds. This case highlights the industrial scale of approval drain attacks.
06
Developer Responsibility & EIPs
Developers can architect safer systems to protect users.
- Implement EIP-2612 (Permit): Allows off-chain approval signatures for single transactions, eliminating persistent allowances.
- Use EIP-3009 (Transfer With Authorization): Similar to permit but more flexible for relayed transactions.
- Clear UX Warnings: Prominently display the requested allowance amount and contract details.
- Default to Limited Approvals: Design DApps to request only the necessary amount for the immediate action.
examples
APPROVAL DRAIN
Real-World Examples & Case Studies
These case studies illustrate how approval drain attacks have been executed, their impact, and the evolving tactics used by attackers.
02
Unlimited USDC Approval Exploit
A classic case where a user granted an unlimited spending allowance for USDC to a malicious contract.
- Attack Vector: After the approval was signed, the attacker's contract could call
transferFromat any time to drain the full USDC balance. - Key Lesson: This highlights the critical risk of signing approvals for infinite amounts (
type(uint256).max). Best practice is to approve only the exact amount needed for a specific transaction.
03
The ERC-20 Permit Phishing Attack
This case exploits the EIP-2612 permit function, which allows setting approvals via a signature, not a transaction.
- How it Works: A phishing site tricks a user into signing a
permitmessage, which grants approval directly. The user never sees a transaction pop-up, making the attack more stealthy. - Impact: The attacker gains immediate spending rights without the user sending an on-chain
approvetransaction, bypassing a common wallet warning.
04
Malicious Airdrop & Revoke.cash Imitation
A sophisticated attack that combined a fake token airdrop with a spoofed security tool.
- Double-Deception: Users were first tricked into claiming a malicious token, which required a harmful approval. Then, to "secure" their wallet, they were directed to a fake version of Revoke.cash.
- Result: The fake site prompted users to sign a transaction that actually increased the attacker's allowances, exacerbating the drain instead of stopping it.
05
The Batch Approval Drain
An attack leveraging a single signature to gain approval for multiple tokens simultaneously.
- Mechanism: A malicious contract uses a function like
multicallor a custom function that bundlespermitorapprovecalls for several tokens the victim holds. - Efficiency for Attackers: This method maximizes the loot from a single victim interaction, draining USDC, DAI, and other ERC-20s in one go after the initial signature.
06
Wallet Security & Prevention Tools
This card outlines the defensive tools and practices that have emerged in response to approval drains.
- Approval Revocation Tools: Services like Revoke.cash and Etherscan's Token Approval Checker allow users to review and revoke active allowances.
- Wallet Guardrails: Modern wallets (e.g., Rabby, MetaMask) now feature approval simulation and warnings for high-risk or infinite approvals.
- Best Practice: The industry standard is shifting towards allowance-based approvals and deadline-limited permits to minimize exposure.
ATTACK VECTOR COMPARISON
Approval Drain vs. Other Wallet Threats
A technical breakdown of how approval drain attacks differ from other common wallet security threats in mechanism, user interaction, and persistence.
| Attack Characteristic | Approval Drain | Seed Phrase Theft | Malicious Transaction | Frontend Hijack |
|---|---|---|---|---|
Primary Vector | Smart Contract Interaction | Phishing / Malware | Transaction Signing | Compromised Website/API |
User Action Required | Sign an approval transaction | Reveal secret recovery phrase | Sign a malicious transaction | Visit a compromised dApp frontend |
Funds Stolen From | Approved tokens in the wallet | Entire wallet and all assets | Specific assets in transaction | Assets during the dApp session |
Attack Persistence | Indefinite (until revoked) | Permanent (wallet control lost) | One-time (single transaction) | Session-based or until fix deployed |
Stealth Level | High (no immediate fund movement) | High (full control gained silently) | Low (visible in transaction preview) | Medium (masquerades as legitimate action) |
Recovery Action | Revoke token approvals | Abandon wallet, migrate funds | Cannot recover after signing | Clear cache, use alternative frontend |
Common Prevention | Use approval revoke tools, limit allowances | Use hardware wallet, never share seed | Verify transaction details before signing | Bookmark trusted URLs, use security plugins |
prevention-mitigation
APPROVAL DRAIN
Prevention & Mitigation Strategies
Proactive measures and tools to detect, prevent, and recover from token approval exploits.
02
Use Allowance Limits
Instead of granting infinite approvals, set a specific spending limit for the exact amount needed for a transaction. Many modern wallets and dApps now prompt users to set a custom allowance. This practice, known as allowance capping, ensures a malicious contract can only drain a predetermined amount, significantly limiting potential losses.
04
Leverage Permit2 & Smart Wallets
Adopt newer token approval standards and wallet types designed for security:
- Permit2: A unified token approval contract that allows approvals via off-chain signatures, eliminating the need for on-chain
approvetransactions and enabling easy revocation. - Smart Contract Wallets (Account Abstraction): Wallets like Safe or ERC-4337 accounts can implement transaction policies, multi-signature requirements, and spending limits, providing a structural defense against drainers.
05
Verify Contract Authenticity
Always verify the source and audit status of a smart contract before approving it. Check for:
- Verified source code on block explorers.
- Audit reports from reputable firms.
- Community reputation and project longevity. Be wary of contracts that request approvals immediately upon connecting your wallet or that mimic the interfaces of popular dApps (phishing clones).
DEBUNKED
Common Misconceptions About Approval Drains
Approval drains are a prevalent threat, but many users and developers hold incorrect beliefs that increase their risk. This section clarifies the most dangerous and widespread misconceptions about token approvals and smart contract interactions.
No, an approval drain is fundamentally different from a wallet hack. A wallet hack involves the theft of a private key or seed phrase, granting an attacker complete and permanent control over the wallet and all its assets. An approval drain exploits a specific, user-granted permission (an approve() transaction) for a single token to a malicious smart contract. The attacker can only move the specific token amount you approved, and your wallet's core private key remains secure. The risk is limited to the approved token and amount, not your entire portfolio.
APPROVAL DRAIN
Frequently Asked Questions (FAQ)
Approval Drain is a sophisticated form of crypto theft that exploits excessive or residual token allowances. These questions address how it works, how to prevent it, and its impact on security.
An approval drain attack is a security exploit where a malicious actor uses a previously granted, excessive token allowance to transfer assets from a victim's wallet without their current consent. It works by exploiting the approve or increaseAllowance function in token contracts like ERC-20, which allows a designated spender (e.g., a DEX) to withdraw tokens up to a specified limit. Attackers gain access to these permissions through phishing, malicious smart contracts, or compromised frontends, then call the transferFrom function to drain funds up to the approved amount. Unlike a direct private key compromise, this attack leverages legitimate, pre-authorized on-chain permissions that the user may have forgotten or failed to revoke.
further-reading
APPROVAL DRAIN
Further Reading & Resources
Deepen your understanding of approval drain attacks, their prevention, and the security tools designed to combat them.
01
Understanding Token Approvals
A token approval is a permission granted by a user's wallet to a smart contract, allowing it to spend a specific amount of tokens on the user's behalf. This is a core DeFi mechanism for interactions like swapping on a DEX or providing liquidity. The risk arises when users grant unlimited approvals or fail to revoke permissions to malicious or deprecated contracts.
02
Common Attack Vectors
Approval drain attacks exploit these permissions through several methods:
- Malicious DApps: Fake or compromised websites trick users into signing approvals for malicious contracts.
- Signature Phishing: Users are tricked into signing a malicious
permitorapprovetransaction disguised as something else. - Contract Compromise: A previously legitimate, approved contract is hacked, turning its permissions into a vulnerability.
03
Prevention & Best Practices
Users and developers can mitigate approval drain risks:
- Use Limited Approvals: Always approve only the exact amount needed for a transaction, never an unlimited amount.
- Regularly Review & Revoke: Use approval management tools to audit and revoke unused permissions.
- Verify Contracts: Interact only with verified, audited contracts from reputable sources.
- Wallet Features: Use wallets that offer simulation or explicit warnings for approval transactions.
05
The ERC-20 Permit Standard
EIP-2612 (permit) is a gasless approval standard that allows users to approve token transfers using a signature (off-chain) instead of an on-chain transaction. While convenient, it introduces a new attack surface for signature phishing. Users must be extremely cautious about signing permit messages, as they can be as dangerous as a standard approval transaction.
06
Security Audits & Monitoring
For developers, preventing approval-related exploits is critical:
- Smart Contract Audits: Ensure contracts properly handle approval logic and resist reentrancy.
- Event Monitoring: Monitor for unusual patterns of
ApprovalorApprovalForAllevents from user wallets. - Real-time Alerts: Services like Chainscore and Forta Network can detect and alert on suspicious approval patterns linked to known malicious addresses.
ENQUIRY
Get In Touch
today.
Our experts will offer a free quote and a 30min call to discuss your project.
NDA Protected
Confidentiality24h Response
Time to ValueDirectly to Engineering Team
No Sales Fluff10+
Protocols Shipped
$20M+
TVL Overall