Token approvals explained: what you are signing and how to revoke it

Sooner or later every wallet shows a request that says something like "allow this site to spend your tokens". That is a token approval. It is a normal part of how decentralized apps work, and it is also one of the most common ways people lose funds. Understanding it takes five minutes and protects you for as long as you use crypto.

Why approvals exist

A smart contract cannot take tokens from your wallet on its own. When you swap a token, lock it or stake it, the contract needs your permission to move a certain amount on your behalf. The approval is that permission. It names two things: the spender (the contract that may move the tokens) and the allowance (how many tokens it may move).

The coin that pays the network fee, such as PEPU on Pepe Unchained or ETH on Ethereum, does not need an approval: it is sent with the transaction itself. Approvals are for tokens.

The problem with unlimited approvals

Many apps ask for an unlimited allowance so you never have to approve again. That is convenient, but the permission does not expire. If the contract is later exploited, or if you approved a malicious contract by mistake, the spender can move every token of that type you hold, today or months from now, without asking again.

An exact approval, for just the amount the action needs, limits the damage to that amount. It costs one more small transaction the next time, which is a fair price for the protection.

How to read an approval request

• Look at the token: is it the one you meant to use?
• Look at the spender address: is it the contract of the app you are using? A known app publishes its contract addresses.
• Look at the amount: is it the amount of your action, or "unlimited"? Most wallets let you edit it.
• Be suspicious of approvals and signatures you did not expect, especially right after clicking a link someone sent you.

Signatures can be approvals too

Some approvals do not look like transactions. A "permit" is a signed message that grants an allowance without a transaction and without a network fee. Scam sites like them because the request looks harmless. Treat any signature that mentions a spender, a value or a deadline as seriously as an approval transaction.

How to revoke an approval

Revoking means setting the allowance back to zero. It is a normal transaction that costs a small network fee. On the PEPU BANK Security page you can connect a wallet, see the approvals it has given, and revoke any of them in one tap; connecting only reads your public address, and nothing is signed until you press Revoke.

A good habit is to review your approvals every few months, and immediately after you suspect you signed something you should not have.

What PEPU BANK does by default

On PEPU BANK, Penk Shield makes every approval request exact and only to PEPU BANK contracts on its allowlist, and it explains each request in plain words before your wallet opens. That reduces the risk on our site, but the habits above are what protect you everywhere else.