Tokens, NFTs and approvals

When you hand your car keys to the hotel valet, you expect the car to be parked. Not driven off on holiday. Token approvals on Ethereum work much the same – except the keys often go to someone you have never seen, and for good.

ERC-20 tokens#

Most tokens on Ethereum – USDC, USDT, project tokens – follow the ERC-20 standard. A token is really a smart contract with a table of "who holds how much". When you send a token, you do not move a coin; you ask the contract to update the table.

Watch out for fake tokens. Anyone can create a token called "USDC". You recognise the real one only by its contract address – check it on the issuer's website or in a block explorer.

NFTs#

NFTs follow the ERC-721 or ERC-1155 standards. Every piece has its own number, so one cannot be swapped for another. An NFT often holds only a link to an image stored elsewhere – if the server with the image disappears, the NFT stays but the image does not.

Approvals to spend#

When you want to swap USDC for ETH on an exchange, the exchange has to "take" your USDC. For that it needs an approval: you sign a transaction saying the exchange's contract may spend up to a certain number of tokens from your account.

For convenience many apps ask for an unlimited approval, so you do not have to give it again. But that approval stays valid until you revoke it. If the contract gets hacked later, the attacker can take all your tokens of that kind – even a year on.

Signatures that do not look like transactions#

Some approvals are not transactions but just a signed message (Permit, Permit2). It costs nothing, the wallet shows a jumble of text – and scammers abuse it. You sign a "login" on a fake website and actually give away an approval to your tokens. According to the firm ScamSniffer, this accounted for 38% of losses in large signature thefts in 2025.

How to check and revoke approvals#

In the Etherscan explorer (the Token Approvals section) or in tools like revoke.cash you enter your address and see all approvals. Revoke the ones you do not need – a revoke is a transaction and costs a small fee. Do it on the layer 2 networks where you use apps too.

Common myths#

• "A token called USDC is USDC." Only the one with the verified contract address is.
• "A signature without a fee is harmless." A Permit signature can give access to all your tokens.
• "Approvals expire on their own." An unlimited approval lasts until you revoke it.