DEV Community

cryptostrapon
cryptostrapon

Posted on

How "approval phishing" drains wallets without stealing a key (and how to check it in 10 lines)

#crypto #web3 #security #beginners

Most people picture a crypto theft as "someone got my seed phrase". A large share of wallet drains we see in scam reports works differently: the victim signs one innocent-looking message, and the attacker never touches the key.

This post explains the mechanism and shows a short script that checks whether a token approval is unlimited.

What an approval is

ERC-20 tokens let you give another address (a "spender") the right to move your tokens, up to some amount. Exchanges, DEXs and games use this all the time:

  1. You call approve(spender, amount) on the token contract.
  2. The spender can later call transferFrom(you, anywhere, amount) without asking you again.

The risk: many dapps ask for MaxUint256 (unlimited) so you don't have to approve again. If that spender is a scam contract, or a legitimate one that later gets compromised, it can empty that token from your wallet at any time. The approval stays valid until you revoke it.

How scams use it

The pattern is simple and repeated across fake airdrop sites, fake "claim" pages and cloned mint pages:

  • A page tells you to "verify your wallet" or "claim your reward".
  • Your wallet pops up a signature or approval request. The text looks harmless, or is hard to read.
  • You sign. The scammer's contract now has an allowance.
  • Funds move later, sometimes days after, so the link to that page is easy to miss.

Off-chain signatures such as permit / Permit2 can do the same job without you paying gas for an approval transaction, which is why "it was free" is not a safety signal.

Check an allowance yourself

With ethers v6:

import { ethers } from "ethers";

const ERC20 = ["function allowance(address owner, address spender) view returns (uint256)"];

const provider = new ethers.JsonRpcProvider(process.env.RPC_URL);
const token = new ethers.Contract(process.env.TOKEN, ERC20, provider);

const allowance = await token.allowance(process.env.OWNER, process.env.SPENDER);
console.log(allowance === ethers.MaxUint256 ? "UNLIMITED allowance" : allowance.toString());
Enter fullscreen mode Exit fullscreen mode

Run it with your own wallet address, the token address and the spender you want to check. An unlimited allowance to an address you don't recognise is the red flag.

What to do

  • Revoke approvals you don't use. Block-explorer "token approvals" pages and revoke tools let you set the allowance back to zero.
  • Prefer exact amounts over "unlimited" when your wallet offers the choice.
  • Read what you sign. If the request mentions approve, setApprovalForAll, permit or a long hex blob you can't parse, stop.
  • Use a separate wallet with little in it for new or unfamiliar sites.

Practice it

We turned these patterns into a free quiz: 50 scenarios, in one HTML file, no tracking. Try a few and see which ones you would have signed:

Both are open (code under MIT, content under CC BY 4.0), so you can reuse or translate them. If you want a quick sanity check on a suspicious site or token, our free checker is at https://cryptostrapon.com.

Top comments (0)