The July 16, 2024 exploit of the LI.FI protocol, which drained $11.6 million from 153 wallets, exposed a vulnerability that has plagued DeFi users for years: infinite token approvals. While the protocol itself suffered a smart contract flaw, the damage was entirely preventable at the user level. Understanding and managing token approvals is one of the most critical security practices for anyone participating in decentralized finance.
The Threat Landscape
Token approvals are a fundamental mechanism in DeFi. When you interact with a smart contract, whether to swap tokens on a decentralized exchange, provide liquidity, or bridge assets across chains, you must grant the contract permission to spend your tokens. The default in many early DeFi interfaces was to request unlimited spending approval, allowing the contract to access any amount of that token from your wallet at any time. With Bitcoin at $65,097 and Ethereum at $3,443, the value at risk from unchecked approvals has never been higher.
The LI.FI incident is far from isolated. In 2024 alone, exploits targeting approval mechanisms have resulted in losses exceeding hundreds of millions of dollars across multiple protocols. Attack vectors range from compromised smart contracts to phishing attacks that trick users into granting malicious approvals.
Core Principles
The first principle of approval security is minimal exposure. Every token approval should grant only the exact amount needed for a single transaction. If you are swapping 1,000 USDC, the approval should be for exactly 1,000 USDC, not unlimited. Modern DeFi interfaces increasingly default to exact approvals, but many users still carry legacy infinite approvals from earlier interactions.
The second principle is regular auditing. Just as you would review your bank statements for unauthorized charges, you should periodically review your on-chain approvals. Every approval you have ever granted remains active until you explicitly revoke it. A protocol you trusted six months ago may have suffered a vulnerability since then.
The third principle is compartmentalization. Consider using separate wallets for different DeFi activities. A wallet dedicated to bridge interactions should not hold your long-term holdings. Hardware wallets should be reserved for storage, not active DeFi participation.
Tooling and Setup
Several tools make approval management straightforward. Revoke.cash is a free, open-source tool that scans your wallet for all active approvals across multiple chains and allows you to revoke them with a single click. Etherscan’s token approval checker provides similar functionality for Ethereum specifically. Rabby Wallet, a browser extension, simulates transactions before execution and flags suspicious approval requests.
For power users, consider setting up a dedicated DeFi interaction wallet with limited funds. Connect this wallet to DeFi protocols and keep your primary holdings in a separate, approval-free wallet. This creates a natural firewall between your active DeFi capital and your long-term holdings.
Ongoing Vigilance
Approval security is not a one-time task. Every new protocol interaction introduces new approval risk. Before connecting your wallet to any new platform, research its audit history, team reputation, and time in operation. Be particularly cautious with newly launched features or contract upgrades, as the LI.FI exploit demonstrated that even established protocols can introduce vulnerabilities through new facets.
Monitor security channels on social media and subscribe to alerts from blockchain security firms. Rapid response to newly disclosed vulnerabilities can mean the difference between safety and catastrophic loss. When a vulnerability is announced, the first action should be revoking all approvals for the affected protocol.
Final Takeaway
The $11.6 million lost in the LI.FI exploit was entirely preventable. Not a single wallet with finite approvals was affected. The technology to manage approvals exists, is free, and takes minutes to use. The gap between knowledge and action is where most losses occur. Make approval auditing a monthly habit, default to exact approvals, and compartmentalize your DeFi activities. In an ecosystem where smart contract risk is inherent, user-level security practices remain your most powerful defense.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research and consider consulting with a security professional.
the LI.FI exploit was 11.6M from 153 wallets and most of those victims had no idea they even had infinite approvals sitting there
revoke_addict_ 153 wallets is nothing. there are probably millions of wallets with infinite approvals from 2021 that people forgot about completely
11.6M across 153 wallets averages 75k per victim. all from infinite approvals they forgot about. revoke.cash takes 30 seconds and most people still dont check
allowance_trim_ the 75k average loss per wallet in LI.FI should be the industry case study. instead protocols still default to unlimited and users still click approve without reading
Uniswap v3 defaults to exact approvals now but the frontend still suggests unlimited for gas optimization. the gas difference is literally cents. theres no excuse
Sebastiaan V. the gas argument is cope. exact approval costs maybe 5k more gas on a swap. paying 2 cents to save yourself from a total balance drain
Sebastiaan V. uniswap v3 defaults to exact approvals but the frontend still pushes unlimited for gas. the 5k gas difference is literally cents and saves your entire balance
revoke.cash should be bookmarked by anyone touching DeFi. i check mine weekly now after almost getting drained on a rogue Uniswap router
the default being unlimited approval is such a bad UX pattern. protocols should ask for exact amounts and nothing more
Uniswap v3 switched to exact approvals. others should follow. the gas difference is negligible compared to the risk
v3 proving exact approvals work at scale should have been the end of infinite approvals everywhere. protocols that still default to unlimited in 2024 are negligent
the gas difference argument against exact approvals was always weak. we are talking cents vs potential total loss
defi_casualty the gas argument was always cope from lazy devs. exact approval costs maybe 5k more gas on a swap. thats pennies vs losing your entire balance
the worst part is most users dont even see the approval amount. metamask just shows approve and people click. education alone wont fix this, we need protocol level changes
wallets need to start showing approval amounts in big red text. burying it in the transaction details is a UX failure
Emeka O. wallets showing approval amounts in red text is the bare minimum. rabby wallet already does this and its embarrassing that metamask still doesnt
exact approval costs 5k more gas. at 3 gwei that is literally one cent. one cent vs losing your entire balance. the gas optimization argument was always bad faith from lazy frontend devs
153 wallets drained and im willing to bet millions more are sitting with infinite approvals from 2021 they forgot about
Tariq O. millions of wallets with infinite approvals from 2021 is the ticking time bomb nobody talks about. revoke.cash should be a browser default at this point
revoke.cash should be bookmarked by every DeFi user. checking your approvals once a week takes 30 seconds and could save you thousands
LI.FI lost 11.6M from 153 wallets. averages to about 75k per wallet. all because of approvals people forgot they signed months earlier
Dimitri V. 75k average loss per wallet is insane. people still dont check their approvals on etherscan even now
allowance_spender 75k avg loss and people still blindly clicking approve on every new farming contract. darwin awards
Dimitri V. 75k average loss per wallet and people still complain about the gas to set exact approvals. behavioral economics is undefeated
revoke.cash is literally the most important bookmark in crypto. checked mine after this article and found 40 open approvals
153 wallets drained for 11.6M and metamask still doesnt show approval amounts by default. rabby does it, some L2 wallets do it. no excuse for the market leader
coin_pocket_ 153 wallets and Metamask still buries approval amounts in transaction details. Rabby shows them in plain text. no excuse for the market leader to have worse UX than a smaller wallet