Skip to content
Last updated 2026-11-05

DApp Approval Scam

An approval is a standing permission: you sign once, and a contract can move your tokens later without asking again. Read what each request grants, and revoke what you do not need.

Who this is for

Anyone who swaps, stakes, mints, or claims on a third-party site, and anyone who has pressed Approve without reading the amount.

How the scam works

Two functions cover most of it. approve(spender, amount) sets an allowance for one token, and setApprovalForAll(operator, true) gives an operator control over every token in a collection, which is what an NFT marketplace usually requests. Wallets often offer an "unlimited" option, which is the maximum number the contract accepts.

The danger is duration, not the click. An unlimited allowance can be used next week, next month, or after you deposit more tokens. The attacker does not need your key, does not need you to be online, and only needs the approval to remain on a working contract.

A permit signature is the version with no gas transaction. You sign a message off-chain, and the signature itself creates an allowance that someone can submit later. A "sign to verify" or "sign to receive" prompt can be a permit in disguise, and the same applies to setApprovalForAll hidden inside a mint or claim flow: the screen says mint, the transaction grants control of the collection.

The spender can also be a fresh contract that copies a real router's name, reached through a good copy of a real DApp. The approval screen shows the spender address, so compare it with the address the project publishes, not with the name in the prompt.

Disconnecting a site does not revoke an allowance. The connection is a session; the approval is a contract permission that survives it. Revoke after use through the wallet's approvals screen or a reputable approval checker, then check the list again after the revocation confirms.

Revoking costs gas

A revocation is a transaction, paid in BTG on Bitgold. If it fails or is dropped, the allowance stays open, which is why you verify the list afterward instead of assuming the click worked.

Warning signs

  • The requested amount is unlimited, or the amount field is empty or set to the maximum.
  • setApprovalForAll appears when you expected a mint, a single purchase, or a claim.
  • A signature prompt costs no gas and does not explain what it authorizes.
  • The spender address is not the contract the project documents.
  • The site requires an approval before it shows a price, a balance, or a withdrawal button.
  • You are asked to "increase allowance" for the same token a second time.

If it happens to you

  1. Open the wallet's approvals screen, or a reputable approval checker, and list every allowance for the affected address.
  2. Revoke what you do not recognize, starting with unlimited allowances and setApprovalForAll. Each revocation is a transaction and costs gas.
  3. Reload the list after the transactions confirm. A failed revocation leaves the permission open.
  4. If tokens are already moving, move the rest to a new wallet first. An approval can be used again until it is revoked.

Next steps

Self-check

  • Can you tell approve from setApprovalForAll in a wallet prompt?
  • Do you know whether your last swap left an unlimited allowance behind?
  • Do you know that a gas-free signature can still grant spending rights?
  • After disconnecting from a site, would you still check approvals?