Approval Phishing

Overview

What it means and why it matters

Approval phishing tricks a wallet user into authorizing a malicious token allowance or signing permission that enables later asset movement. The immediate interaction may look harmless because it is not a direct transfer.

How it works in practice

A deceptive website asks the user to approve a smart contract as a token spender or sign a permit-like message. If the approval grants broad allowance, the contract or attacker can later transfer eligible tokens under the granted authority. The user may not notice an immediate balance change.

Technical detail without the jargon

Inspect chain, token contract, spender, allowance amount and signature deadline. Some permits are off-chain signatures that can be submitted later; simply waiting for an immediate outgoing transaction misses the risk. Revocation may reduce future exposure but cannot reverse transfers already executed.

A deeper point to understand

Not every wallet confirmation is a payment. Token approvals and typed-data signatures can authorize later action by another party, sometimes with very high limits. When reviewing a prompt, users should identify the contract receiving permission and consider whether the requested access is proportionate to the intended transaction.

Common mistakes and limitations

A wallet prompt labeled ‘verify account’ can actually authorize unlimited token spending. Do not sign unreadable requests or trust a site’s logo as evidence that the spender contract is safe.

What to check in a real payment system

During wallet training, distinguish transfer requests from allowance and permit signatures. Display the exact spender and amount when evaluating a prompt. Revoke unnecessary permissions through trusted tools but warn users that revocation does not return assets already transferred away.

Related concepts

Webhook, Webhook Verification, API Key.

Further reading

Ethereum — Token Approvals.