Before you click “Approve” on any decentralized exchange like Uniswap, understand that this single signature can grant a smart contract access to a specific token in your wallet—and if you approve a malicious or compromised contract, that access can be used to drain your funds. The core safety steps are: verify the token contract address, check the approval amount (ideally use a custom limit), review the dApp’s reputation and code, use a dedicated approval wallet, and revoke unused approvals afterward. Skipping these steps is how most wallet drains happen, even among experienced users.
Why Token Approvals Are the Hacker’s Favorite Door
When you trade on a decentralized exchange, you don’t send tokens directly to the other party. Instead, you approve the exchange’s smart contract to move a certain amount of your tokens on your behalf. This is standard ERC-20 behavior, and it’s what makes automated trading possible. But the same mechanism that allows Uniswap to swap your tokens also allows any contract you approve—even a fake one—to transfer them without asking again.
The Difference Between “Approve” and “Transfer”
A transfer moves tokens from your wallet to another address. An approval does not move anything; it merely gives a third-party contract permission to transfer later. Many phishing sites trick users into thinking approval is harmless because no funds leave the wallet immediately. The danger is that once approved, the contract can execute the transfer at any time, in any amount up to your allowance.
Why Unlimited Approvals Are So Common (and Risky)
Most major DEX interfaces, including Uniswap’s, default to an “unlimited” approval for convenience—this means you approve a huge number (often the maximum uint256) so you don’t have to sign again for future trades. The risk is not with Uniswap itself, which is battle-tested, but with the habit of clicking “max” on any random dApp you encounter on a phishing link or a fake token page.
Step-by-Step: The Five Safety Checks Before You Sign
Follow this checklist every time, even on sites you think you know. A single skipped step can cost you your entire balance.
- Verify the token contract address — Never trust the symbol or name shown in your wallet. Copy the address from the official project website or a trusted aggregator like CoinGecko, and compare it character-by-character with the one in the approval request.
- Check the dApp’s URL and domain history — Phishing sites often use lookalike domains (e.g., “uniswap.exchange” instead of “uniswap.org”). Bookmark the real URL and check the SSL certificate is valid.
- Set a custom approval amount — Instead of unlimited, approve only the exact amount you need for the current trade. You’ll pay a small extra gas fee for future approvals, but you cap your exposure to that single contract.
- Review the contract address you’re approving — On the approval popup, your wallet shows the contract address. Cross-check it against the official DEX’s documented router address (e.g., Uniswap’s router), not just the front-end you’re on.
- Use a burner wallet for new tokens — If you’re buying a low-liquidity or brand-new token, do it with a wallet that holds only a small amount of funds, not your main savings wallet.
How to Revoke Approvals You No Longer Need
Even if you followed every step, your wallet is still exposed to every approval you’ve ever made. Old approvals on compromised contracts or forgotten test tokens are a common attack vector. You should periodically clean them up.
Manual Revocation via Blockchain Explorers
You can use Etherscan’s “Token Approvals” tool (or similar tools on other chains) to view all active allowances for your address. From there, you can submit a transaction that sets the allowance to zero. This costs gas, but it’s the most reliable method.
Using Revocation Dashboards
Services like Revoke.cash aggregate your approvals across multiple chains and let you revoke with a few clicks. Be careful: only use well-known dashboards and double-check the URL, as fake revocation sites have appeared. If a “revoke” tool asks for your seed phrase, it’s a scam; real tools only ask for a wallet connection and a signature.
What to Do If You’ve Already Approved a Suspicious Contract
If you suspect you approved a malicious contract, do not panic—but act quickly. The key is to make the approval worthless before the attacker uses it.
- Transfer your tokens out — Move all tokens that are exposed (including the ones you approved) to a brand-new wallet. This is the fastest way to break the approval’s power.
- Revoke the approval immediately — If you can’t move funds (e.g., they’re staked), use a revocation tool right away to set the allowance to zero.
- Do not interact with the same wallet again — Even after revocation, assume the attacker has your address and may try phishing you later. Create a fresh wallet for future trades.
Advanced Safety: Approval Amount Limits and Hardware Wallets
For higher-value wallets, consider layering protections beyond the basic checklist.
Why Hardware Wallets Don’t Save You from Approvals
A hardware wallet (like Ledger or Trezor) protects your private keys from being stolen, but it does
not protect you from signing a malicious approval. When you approve a bad contract, you are authorizing that contract to move your tokens, and the hardware wallet will happily sign that authorization because it’s a valid transaction. Your hardware wallet is only as safe as the contract you approve.
The “Allowance Reset” Habit
After you finish trading a specific token, make it a habit to reset that token’s allowance to zero. This is especially important for tokens you rarely use. The extra gas cost is trivial compared to the risk of holding an open allowance for months.
Final Rule: Treat Every Approval Like a Withdrawal
The mental shift that protects most users is to stop thinking, “This is just a permission,” and instead think, “This is a signed check that can be cashed at any time.” Uniswap and other reputable DEXs are safe to use, but the safety of your wallet depends entirely on your discipline. Verify the address, cap the amount, use a separate wallet for experiments, and revoke what you don’t use. Do that, and you can trade on decentralized exchanges with confidence—without becoming the next statistic in a wallet-drain report.