In-depth essays · #23 / 50 · Wallets, Oracles, Security & Payments

On-Chain Wallet Security: How to Guard Against Unlimited Token Approvals and Permit Phishing

Why wallets get drained without exposing a seed phrase—and how vault separation keeps your assets safe

Many victims of on-chain theft never typed their 12-word seed phrase into a fake site. Instead, their tokens were drained through two everyday mechanics built into token standards: unlimited ERC-20 approvals and off-chain Permit signatures. Understanding how they work makes them easy to defend against.

1. How ERC-20 approve() Works—and the Danger of Unlimited Allowances

Before a DEX or lending contract can pull ERC-20 tokens like USDC from your wallet, you must sign an approve(spender, amount) transaction. To save future gas, many interfaces default the allowance to 2^256 - 1 (unlimited).

If that contract is later exploited—or if the spender address belonged to a look-alike phishing site—anyone controlling that contract can call transferFrom and drain your entire balance of that token without needing another signature.

2. Gasless Permit and Permit2 Signatures: When a Free Click Grants Full Access

Standards like EIP-2612 Permit and Uniswap’s Permit2 let users grant token allowances by signing a free off-chain typed message (eth_signTypedData) instead of sending an on-chain transaction.

Phishing sites disguise a malicious Permit request as a harmless ‘Verify wallet’ or ‘Claim airdrop’ prompt. Once signed, the attacker submits your signature on-chain and sweeps the approved tokens immediately.

3. The Golden Rule: Separate Your Cold Vault from Your Everyday Hot Wallet

Never connect the wallet holding your long-term savings to unfamiliar dApps. Keep savings in a dedicated vault wallet (ideally a hardware wallet) that only ever sends and receives transfers to your own addresses, and use a separate hot wallet funded with small spending balances for trading, minting, and exploring new districts.

4. Routine Approval Hygiene via Block Explorers

Periodically review and revoke stale token allowances using the Token Approvals checker on Etherscan, Basescan, or Arbiscan, and pause whenever a wallet popup displays Approve, Permit, or SetApprovalForAll on an unexpected page.

Related districts in the city

Related glossary terms

This essay is an explainer written to help you read the city; it is not investment advice. Facts on this page are as of 2026-10 and may change. If you spot a mistake, please tell us through the contact page.