The leaks · 42 / 86 · 3 min
Approvals and drainers
An approval lets a contract move a token from your wallet later. A drainer is a page that asks for that permission, or for a signature, and then takes what it can.
An approval lets a contract move a token afterwards. A drainer asks for that permission.
A worked case
A mint asks for an unlimited approval. The mint fails, so the person thinks nothing happened. The approval remains. A later transaction empties the token. The dangerous step was the one that did not look like a payment.
The never-do list
- Do not type the seed into a website.
- Do not approve an unlimited spend for a site you opened from an ad or a DM.
- Do not sign a message you cannot read.
- Do not download a remote-access tool for support.
What an approval can take
If you approved a contract to spend your token, it can move the balance later, in a transaction you do not start. Revoke approvals you do not remember, using a tool you opened yourself.
This course will not teach you how to build a drainer. Knowing the permission is enough to refuse it.
The permission that outlived the mint
An ERC-20 approval lets a contract move your tokens up to an amount you set. Unlimited became the default button because it saves a later transaction. It also means the contract, or anyone who can call it, can empty that token whenever they like, until you revoke. Drainers are pages that ask for this, or for a signature that grants it, often dressed as a mint, a claim, or a security check.
People discovered the damage in public lists of stolen wallets through 2021 and 2022, and revoke sites became normal hygiene the way antivirus once did. The existence of a revoke button is the evidence that the first click was not nothing. A failed mint does not cancel an approval that succeeded. Read the allowance. Set it to the amount you mean, or do not set it.
This page will not name a drainer to visit. The shape is enough: if a site you do not need asks for permission over a token you care about, close it. Revoke what you already granted and do not remember.
Read it yourself
- EIP-20, the token standard that includes approve
- 2020 Twitter scam, the crude cousin of a permission ask
These links are the record. They are not a recommendation, and they are not instructions. A news story or a court paper can still be wrong about a detail. The check does not change because a famous name is in the story.
Apply the check
Open a question. The line is about this topic. It is not a verdict that anything is safe.
The contract that was approved.
That contract, within the allowance you set.
The allowance, until you revoke it.
Check yourself
If you approved a contract last month, can it still move tokens?
Yes, until you revoke that approval or the balance is gone.
After this you can refuse unlimited approvals from links, and revoke ones you do not recognise.