The December 5, 2023 disclosure of a critical vulnerability in ThirdWeb’s smart contracts has put a spotlight on one of the most overlooked aspects of crypto security: token approvals. Every time you interact with a decentralized application — swapping tokens on Uniswap, minting an NFT, or depositing into a yield farm — you grant that smart contract permission to spend tokens from your wallet. Most users never revoke these permissions, leaving their funds exposed to vulnerabilities they may not even know exist. This guide walks you through why approvals matter and exactly how to manage them.
The Basics
When you connect your wallet to a dApp and perform an action, you typically sign a transaction that grants the smart contract an allowance — permission to transfer a specific token on your behalf up to a certain amount. The most common standard, ERC-20, uses two types of approvals: finite approvals that limit the contract to a specific amount, and unlimited approvals that grant permission to spend your entire balance of that token.
Most dApps request unlimited approvals because it saves users from signing approval transactions every time they want to interact. While convenient, this creates a persistent risk: if that smart contract is later compromised or contains a vulnerability, an attacker can drain all of that token from your wallet without any further action on your part. The ThirdWeb vulnerability disclosed on December 5 is a perfect example — it affected widely-used contract templates that thousands of users had already approved.
Why It Matters
With Bitcoin trading above $44,000 and Ethereum near $2,290, the value at risk from unchecked approvals has never been higher. Consider this: the average active crypto wallet has between 10 and 50 outstanding token approvals. Each one represents a potential attack vector. When a vulnerability like the ThirdWeb ERC-2771 flaw is disclosed, attackers immediately scan the blockchain for wallets with active approvals on affected contracts and attempt to exploit them before users can revoke permissions.
The problem compounds over time. As you interact with more protocols, the number of active approvals grows. Many users have approvals for dApps they no longer use, contracts that have been deprecated, or protocols that have been hacked. Each unnecessary approval is an unnecessary risk. Regular approval hygiene is as fundamental to crypto security as using strong passwords is to traditional online accounts.
Getting Started Guide
Step 1: Choose an approval management tool. The most popular free option is revoke.cash, recommended by prominent DeFi developers including DefiLlama’s 0xngmi. It supports multiple blockchains including Ethereum, Polygon, BNB Chain, Avalanche, and Arbitrum. Alternatively, you can use the approval management features built into MetaMask or your hardware wallet’s companion app.
Step 2: Connect your wallet. Visit revoke.cash and connect the wallet you want to audit. The site will scan the blockchain for all active token approvals associated with your address. This process typically takes a few seconds and does not require any gas fees.
Step 3: Review your approvals. You will see a list of every smart contract with permission to spend your tokens, along with the token type and the approval amount. Pay special attention to unlimited approvals (often displayed as a very large number like 115792089237316195423570985008687907853269984665640564039457) and approvals for contracts you do not recognize.
Step 4: Revoke unnecessary approvals. Click the revoke button next to any approval you want to remove. This requires a blockchain transaction, so you will need to pay a small gas fee. Consider revoking in batches during periods of low network congestion to minimize costs.
Step 5: Set a maintenance schedule. Make approval review a regular habit. A good cadence is monthly for active DeFi users and quarterly for casual users. Always perform a review after interacting with a new protocol or after a major vulnerability disclosure.
Common Pitfalls
The most common mistake is ignoring unlimited approvals because the dApp seems trustworthy. Remember that even reputable platforms can have vulnerabilities in their contracts. The ThirdWeb flaw affected contracts used by major projects backed by Shopify and Coinbase. Trust in the team does not equal trust in the code.
Another pitfall is revoking approvals too slowly after a vulnerability disclosure. When a security flaw is publicly announced, the race between users revoking approvals and attackers exploiting them begins immediately. Having your approval management tool bookmarked and knowing how to use it quickly can make the difference between safety and loss.
Some users avoid revoking approvals because of gas fees. While this is understandable during periods of high network congestion, the cost of revoking is always a fraction of the potential loss. Think of gas fees for revocation as an insurance premium for your digital assets.
Next Steps
After cleaning up your existing approvals, adopt better habits going forward. When a dApp asks for an unlimited approval, check if the protocol offers a finite approval option. Some interfaces allow you to manually set the approval amount to match your intended transaction. Consider using a dedicated wallet for interacting with new or untested protocols, keeping your main holdings in a separate wallet with minimal approvals. Hardware wallets provide an additional layer of protection by requiring physical confirmation for every transaction, including approval revocations.
Stay informed about security disclosures by following reputable sources in the Web3 security community. BlockSec, Certik, and OpenZeppelin regularly publish vulnerability reports and actionable guidance. Being proactive about approval management is one of the simplest and most effective ways to protect your crypto assets in an increasingly complex decentralized landscape.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
been saying this for years. check your approvals on revoke.cash at least once a month. the amount of people with unlimited USDC approvals from 2021 is terrifying
revoke.cash should be bookmarked by every defi user. found approvals from 2021 for protocols that got exploited months ago. revoked everything and now do weekly checks.
approvals zero is right about revoke.cash. found a USDC approval from a dApp that rugged in 2022 still sitting in my wallet last month. been doing monthly checks since
“null_approval checking revoke.cash monthly and finding a 2021 usdc approval from a rugged protocol. been doing quarterly checks since and every single time i find something”
The unlimited approval thing is such a UX trap. dApps default to it because users complain about signing twice, but its a ticking bomb
^ exactly. metamask should show a warning when a contract asks for unlimited approval. this is a wallet-level problem not just a user education problem
Wei G. metamask showing a warning for unlimited approvals would fix 90% of this overnight. wallet teams just dont want the friction
unlimited approvals are a lazy UX shortcut. some wallets like Rabby now show the actual approval amount and risk level. should be the standard across all wallets.
Rabby showing amounts is nice but users still click through without reading. the default should be finite approval and unlimited should require an explicit opt-in toggle
the only real fix is making unlimited approvals require typing the token amount manually. friction works when warnings dont
ux_is_security finite approval should be the default. making unlimited the opt-in toggle would fix 90% of this overnight
wallet_nerd_ rabby making you type the amount manually is such a simple fix. metamask still hasnt copied it which tells you where their priorities are
“pwn_or_pwn rabby requiring manual amount entry is such a simple fix that its embarrassing metamask hasnt copied it. one extra click vs losing your entire wallet balance”
Rabby showing risk level is a start but most users are on MetaMask which still gives you a cryptic hex string for blind signing. wallet market share matters here
sigrid calling unlimited approvals a UX trap is spot on. the article mentions ThirdWeb and their fix was good but the real solution is wallets defaulting to finite approvals
thirdweb disclosure dec 5 2023 and people still havent checked their approvals. erc20 unlimited approvals are a ticking bomb
Good guide but you missed one thing: some contracts have time-locked approvals that look revoked but arent. always verify on-chain
“auditbrain_ time locked approvals is a great point. revoked on the ui but still active on chain. thats why revoke.cash alone isnt enough, you need to verify the actual tx on etherscan”
ThirdWeb was the wakeup call but half the people reading this still have unlimited USDC approvals from dApps that rugged in 2022. go check revoke.cash right now
Theo M. thirdweb was the wake up call but i bet half the readers here still havent checked revoke.cash. its been 2 years
finite_only the real problem is metamask still hasnt added a simple toggle for unlimited vs finite. rabby did it years ago
found a Paraswap approval from 2021 still active last week. two years of exposure and i consider myself careful
ethersnap para was one of the worst offenders. their contract asked for unlimited on every token by default
been doing monthly revoke checks since 2022. found three stale approvals last week from protocols that dont even exist anymore. wild
CryptoBob i check revoke.cash weekly and still find stale approvals. thirdweb dec 2023 was the wakeup call most people ignored
CryptoBob monthly checks since 2022 and you still found 3 stale ones. shows how fast this stuff accumulates without discipline