This is fantastic for creating seamless interactions between various dapps, smart contracts, and wallets, allowing users to explore limitless combinations of new and creative ways to utilize their financial assets.<\/p>\n\n\n\n
However, with great power comes great responsibility. To enable this revolutionary interoperability DeFi uses widely accepted standards that are as simple as they are powerful. Users can create a DeFi wallet<\/a> and start trading significant capital across different dapps with only a few clicks. But this ease of use also means that should they make a mistake, their funds can be permanently lost. <\/p>\n\n\n\n DeFi applications (dapps) utilize smart contracts<\/a> to manage their interactions with user wallets. Smart contracts, in turn, must be granted access to utilizing the funds in a user’s specific wallet before they can perform their duties. Granting this access is done via token approvals<\/strong>.<\/p>\n\n\n\n In today’s blog, we’ll be discussing this simple technical concept and why an understanding of how to manage token approvals is essential to keeping your crypto assets safe.<\/p>\n\n\n\n Token approvals govern the specific crypto assets that certain smart contracts are allowed to utilize within your crypto wallet. They are granted by using your management control over the said wallet to approve a specific request generated by the smart contract you wish to interact with.<\/p>\n\n\n\n In the screenshot below, you can see the process of granting a token approval for the Uniswap dapp to interact with the USDT stablecoin<\/a> stored within a MetaMask wallet. This token approval uses a specific custom spending cap as well:<\/p>\n\n\n While token approvals are mainly used for managing ERC-20 permissions, keep in mind that ERC-721 and ERC-1155<\/a> NFT token standard approvals are also common. <\/p>\n\n\n\n How does this work from a technical perspective? Let\u2019s say you are about to deposit USDC<\/a> into a vault. A typical deposit function should involve transferring the staking token from your balance to a strategy bound to the vault so that yield can be generated on the deposited amount. This is done by calling the transferFrom() function – a standard function each token based on the ERC-20 standard has. <\/p>\n\n\n\n https:\/\/github.com\/OpenZeppelin\/openzeppelin-contracts\/blob\/master\/contracts\/token \/ERC20\/ERC20.sol <\/em><\/a><\/p>\n\n\n\n But only contracts approved by you can call a token transfer from your balance. Thus, before depositing, swapping, lending, placing buy\/sell orders, or calling any other functionality that should send your tokens to a particular target, you have to call the approve() function on the contract of the token. <\/p>\n\n\n\n See the approve() call within the Solidity code below:<\/strong><\/p>\n\n\n https:\/\/etherscan.io\/address\/0xa2327a938febf5fec13bacfb16ae10ecbc4cbdcf#code<\/em><\/a><\/p>\n\n\n\n In the image above, the owner parameter would be your address. \u201cSpender\u201d is the dapp contract that should call transferFrom() later on when deposit() is called. <\/p>\n\n\n\n To manually check if you’ve approved a contract to spend your tokens, you can open the Read section of the ERC-20 token contract and input your address and the dapp contract address into the view function \u201callowance\u201d. It will show you the approved token amount: <\/p>\n\n\n\n https:\/\/etherscan.io\/token\/0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48#readProxyContract<\/em><\/a><\/p>\n\n\n\n Now you can see that contracts with your approvals for specific tokens have control over your balance of those tokens. <\/p>\n\n\n\n The risks of token approvals are due to the trust assumptions that you make regarding the smart contracts you are interacting with. These two assumptions are:<\/p>\n\n\n\n While token approvals are a completely normal action to take within DeFi, they can be extremely dangerous in the wrong hands. This is why token approvals are the main attack vector for crypto phishing scams<\/a>. If you’ve approved a malicious contract to be an unlimited spender of a token, your entire balance will likely be wiped out nearly instantly after the approval is confirmed.<\/p>\n\n\n\n There are also scenarios where, even though you have granted permissions to a legitimate smart contract, your wallet funds may be at risk of potential token approval abuse. If a contract that you’ve interacted with before has a vulnerability and is hacked, the hackers may find a way to transfer all tokens from users who have previously granted token approvals to the breached contract. <\/p>\n\n\n\n This is especially dangerous because many dapps prefer to request these unlimited token approvals from users so that they don\u2019t have to call approve() repeatedly. While this is gas efficient, doing so leaves users exposed to a high level of risk.<\/p>\n\n\n\n It’s a best practice to only keep token approvals in place as long as necessary for the transactions you need to conduct. Once the transactions are completed, consider revoking the token approvals you have in place.<\/p>\n\n\n\n As part of our De.Fi DeFi portfolio tracker<\/a> SuperApp, we make it easy to efficiently monitor and revoke the permissions your wallet may have. Our De.Fi Shield revoke permissions tool<\/a> is the perfect accessory for safety-conscious crypto traders.<\/p>\n\n\n\n Sample De.Fi Shield wallet analysis<\/em><\/p>\n\n\n\n To get started, simply navigate to https:\/\/de.fi\/shield<\/a> and connect your web3 wallet to the De.Fi app. Once connected, Shield automatically runs an analysis of 100+ security detectors for each contract, token, and NFT approval. It will then identify all high-risk tokens and smart contracts and provide a detailed description of potential risks. The whole process happens in only a few seconds.<\/p>\n\n\n\n Once high-risk contracts are identified, you have the opportunity to revoke them one by one or to revoke them all at once:<\/p>\n\n\n\n Choosing to revoke will trigger a pop-up that confirms the action and provides approximate gas fee data for the task<\/p>\n\n\n Hitting “Revoke” once again will then trigger an approval process within your web3 wallet. In this example, we’re using MetaMask:<\/p>\n\n\n Once these transactions are approved, you’re all set! De.Fi Shield will update with your new and improved wallet health score free of risky token approvals:<\/p>\n\n\n Ready to get started auditing and securing your onchain assets? Click the link below!<\/p>\n\n\n\n While it is critical to monitor and maintain your wallet’s token approvals, we also recommend being vigilant and ensuring you don’t interact with risky contracts in the first place. With this in mind, we offer De.Fi Scanner, the most comprehensive free smart contract scanner<\/a> in web3.<\/p>\n\n\n\n DeFi users leverage Scanner to run automated audits on projects, tokens, NFTs, or even liquidity pool contract addresses. Simply enter the contract address you would like to analyze and Scanner will produce a security report in a matter of minutes highlighting any potential risk issues you should be aware of.<\/p>\n\n\n\n Users can also freely access a treasure trove of security analysis via our Audit Database<\/a>. It\u2019s web3\u2019s largest database of DeFi project audits with over 9000 security reports from blockchain experts. If you\u2019re considering interacting with a DeFi protocol, chances are you can find a security report within our database.<\/p>\n\n\n\nToken approvals explained<\/h2>\n\n\n\n
![\"metamask](\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/10\/Screen-Shot-2023-10-23-at-12.32.55-PM.png\")
<\/figure>\n<\/div>\n\n\nThe technical process of token approvals<\/h2>\n\n\n\n
![\"transferFrom](\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/09\/token-spender-contract.png\")
<\/figure>\n\n\n\n![\"call](\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/09\/usdc-contract-call-approve.png\")
<\/figure>\n<\/div>\n\n\n![\"contract](\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/09\/contract-authorization-details.png\")
<\/figure>\n\n\n\nThe risks of token approvals<\/h2>\n\n\n\n
You are dealing with a trustworthy smart contract<\/h3>\n\n\n\n
The smart contract you grant approvals to will not be manipulated<\/h3>\n\n\n\n
How to manage token approvals<\/h2>\n\n\n\n
![\"\"](\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/10\/Screen-Shot-2023-10-23-at-6.26.29-PM.png\")
<\/figure>\n\n\n\n![\"two](\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/10\/specific-contract-revoke.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/10\/Screen-Shot-2023-10-23-at-6.43.57-PM.png\")
<\/figure>\n<\/div>\n\n\n![\"revoke](\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/10\/metamask-revoke-permissions.png\")
<\/figure>\n<\/div>\n\n\n![\"defi](\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/10\/improved-wallet-score-after-removing-token-approvals.png\")
<\/figure>\n<\/div>\n\n\nTRY SHIELD NOW<\/a><\/em><\/h3>\n\n\n\n
Staying safe in web3 with De.Fi<\/h2>\n\n\n\n
![\"token](\"https:\/\/de.fi\/blog\/wp-content\/uploads\/2023\/10\/medju_SrG7rWSH_yI4fU2fTOlLRa9IWO0svwSekH0uZe64ZeohFK8mpdqm4uDvIQn7Z_r_AjBT09FQdKQoSaZQ6i1jk_tdzcPfBWXWboge9Yl3TR3xlphe5g379j53r6O5pKpAmKDzaoYP5oUAEUn6Q.png\")
<\/figure>\n\n\n\nTRY SCANNER NOW<\/a><\/strong><\/em><\/h3>\n\n\n\n