Unlimited approvals and permit signatures: the drainer toolkit

On EVM chains, a token contract keeps a list of who may spend your balance. Drainers do not need your seed phrase; they need one entry on that list.

approve(spender, amount)

Lets spender move up to amount of one token from your wallet at any time. Many apps ask for the maximum value (2²⁵⁶−1), which never runs out. If the spender is malicious, or a legitimate contract is later exploited, every token of that type can be taken.

setApprovalForAll(operator, true)

The NFT equivalent: it gives the operator control over every NFT in a collection, including ones you receive later.

permit and Permit2 signatures

A permit is an off-chain signature that creates an approval without a transaction. It costs no gas, so wallets show it as a "signature request" that looks harmless. Anyone holding the signature can submit it. Permit2 batches this across many tokens at once.

How to read the request

1. Find the function. The first four bytes of calldata are the selector: 0x095ea7b3 is approve, 0xa22cb465 is setApprovalForAll, 0xd505accf is permit.
2. Find the spender. Is it the contract of the app you meant to use?
3. Find the amount. Unlimited should be rare.

The signature decoder does this for you: paste the calldata and it names the function, spender and amount, and flags unlimited approvals.

Clean up

Revoke approvals you no longer need with a revoke tool from your chain's block explorer. See how to revoke approvals.

Educational only. #DYOR #NFA