Most people who lose tokens to a malicious contract were not hacked in any technical sense. They approved something, and the approval kept working long after they forgot about it. This guide explains what an approval is, how to look at your own, and — just as importantly — what checking them does not protect you from.
What an approval actually is
Standard fungible tokens do not let a contract take tokens from you. Instead you grant an allowance: a standing permission for a named spender address to move up to a certain amount of a certain token from your address, whenever it likes.
Three properties of that permission matter, and all three surprise people:
- It persists. The allowance is not consumed by the transaction you granted it for. It remains until it is used up or changed.
- It is usually unlimited. Interfaces commonly request the maximum possible value, because it avoids prompting you again and saves gas. That means the permission covers your entire balance of that token — including tokens you acquire later.
- It is address-specific, not app-specific. You are trusting a contract address. If a front end is compromised and asks you to approve a different address, nothing about the site looks wrong.
The BadgerDAO incident is the clearest illustration in our tracker. The protocol’s contracts were never exploited. Attackers injected script into the website that asked users for approvals to an address they controlled, and the approvals did the rest.
How to look at your approvals
Approvals are public on-chain data. You do not need a special service to see them, and we deliberately do not send you to one.
Every major block explorer exposes an approvals or token-approvals view for an address. Paste in your own public address — the one starting 0x that you share to receive funds — and you will see the list of spender addresses your account has authorised, per token, with the allowance amount.
That is a read-only lookup. It requires no wallet connection, no signature and no key. If anything asking to show you your approvals wants you to connect a wallet before it will display them, close it.
Reading the list
You are looking for three things:
- Spenders you do not recognise. An address you cannot tie to a protocol you deliberately used.
- Protocols you no longer use. An allowance granted to a service you stopped using two years ago is still live today.
- Unlimited allowances on large balances. The exposure is the balance, not the amount you originally transacted.
What Conisec will not tell you to do
We are not going to tell you to revoke anything, and we do not link revocation tools. That is a deliberate editorial position, not caution for its own sake.
After any public incident, fraudulent “revoke”, “recovery” and “checker” sites appear quickly, are advertised aggressively, and often rank well for exactly the searches a worried person runs. A publication that routinely sends readers to approval-management interfaces trains precisely the habit those attackers rely on. What to do about an approval you dislike is a decision for you, taken through an interface you already trust and reached by a route you already know.
What this does not protect you from
Reviewing approvals is worth doing, and it is not a security strategy on its own. It does nothing about:
- A compromised seed phrase. If someone has your recovery phrase, allowances are irrelevant — they have the account.
- Signing a malicious transaction. Approvals govern token transfers by a third party; they do not stop you authorising a transfer yourself.
- Off-chain signatures. Some permission schemes and marketplace orders rely on signed messages rather than on-chain allowances, and those will not appear in a standard approvals view.
- Assets on an exchange. Tokens held on a custodial platform are not in your wallet and have no approvals attached.
The habit worth forming
Look at your approvals occasionally, from your own bookmark to a block explorer you already use, when nothing has gone wrong. The worst time to learn this interface is in the twenty minutes after you read that a protocol you use has been exploited — which is precisely the moment a fake version of it will be waiting for you.
Not advice. Conisec reports for information only. Nothing in this article is financial, legal, tax or security advice. Verify against the primary sources linked above before acting on anything.
