How to Revoke Token Approvals: Permit, Permit2 and Drainers
Lesson 3 of 10 · Intermediate
Why can one signature empty a wallet?
Many people think that as long as their recovery phrase is safe, their assets are safe. But on networks such as Ethereum and Tron you can give a smart contract permission to spend tokens on your behalf. That permission is needed to work with decentralised exchanges and DeFi apps. But if you give it to the wrong contract, the owner of that contract can take your tokens without ever needing your key.
The tools that automate this are called drainers: ready-made kits that scammers install on fake sites to identify and withdraw the most valuable assets in a victim's wallet with a single click. According to Scam Sniffer, losses from signature phishing fell about 83 percent in 2025 to roughly 84 million dollars from about 106,000 victims, but Permit and Permit2 remained the most effective methods.
Three kinds of permission you need to know
1. The classic approval (Approve)
When you want to swap Tether for another token on a decentralised exchange, you first send an Approve transaction that lets the exchange's contract move up to a set amount of your Tether. For convenience, many apps ask for an unlimited amount. This permission stays in place until you revoke it, even years later and even if that contract is hacked in the meantime. The equivalent for NFTs is Set Approval For All, which allows moving a whole collection.
2. Permit and Permit2 signatures
Permit is a method where, instead of an on-chain transaction, you give a signed message, and that message plays the role of the approval. Because signing a message costs no fee, the user feels they “haven't done anything”. The attacker later submits that signature on-chain and takes the tokens. Permit2 is a contract many apps use: you grant it permission once, and from then on other contracts are authorised just by signing a message. If you have already granted Permit2 permission, one deceptive signature is enough.
3. EIP-7702 delegation and “sweepers”
Ethereum's Pectra upgrade (May 2025) allowed ordinary wallets to borrow the behaviour of a smart contract by signing a “delegation authorisation”. This is useful for features like paying fees in tokens, but if you delegate your wallet to a malicious contract, that contract can automatically forward any incoming asset to the attacker's address; these are called sweepers. According to Scam Sniffer, citing Wintermute, more than 80 percent of early 7702 authorisations were malicious.
On Tron there are TRC20 approvals too. In addition, a transaction that changes the account permissions can hand control of the account to another address, so take any request to change permissions on a Tron wallet very seriously.
How to read the signing window
A wallet shows a window before every signature. Ask yourself these questions:
- What type of request is it? A simple Connect is harmless, but Approve, Permit, Set Approval For All, an account-permission change and a delegation request all grant spending rights or control.
- Who is the spender or operator? The address receiving the permission should be the official contract of that app. If the address is unknown, hold back.
- What are the amount and the deadline? In a Permit signature, look at fields such as value and deadline. A huge number means unlimited.
- Does it match what you meant to do? A site that is supposed to give you a “prize” has no reason to ask for permission to spend your Tether.
If your wallet offers transaction simulation (a preview of which assets will leave after you sign), turn it on. On a hardware wallet, “blind signing” means approving something the device cannot decode for you; avoid it as far as possible.
Reviewing and revoking approvals
Revoking an approval means sending a transaction that sets the allowance to zero. A few practical points:
- The major explorers have a section for viewing approvals (for example Token Approvals on Etherscan), and independent tools such as Revoke.cash do the same across several networks. Open these tools only from a trusted source; fake copies exist.
- Each on-chain revocation costs a fee. Prioritise unlimited approvals, approvals for apps you no longer use, and anything unfamiliar.
- With Permit2, check the internal permissions separately; seeing the approval to Permit2 itself is not enough.
- If you have delegated your wallet to a contract you do not recognise, use the option to revoke the delegation or move your assets to a fresh wallet.
- An important limit: revoking helps only when your key is intact. If your recovery phrase has leaked, revoking is useless and you must immediately migrate to a new wallet with new words.
A good habit is to grant approvals only for the size of the trade, not unlimited, and to keep your everyday wallet separate from your main one.
Common mistakes
- Assuming that signing a message is harmless because it costs no fee.
- Granting unlimited approvals to every app and forgetting them forever.
- Approving a delegation request or an account-permission change without knowing the destination contract.
- Using blind signing on a hardware wallet on unknown sites.
- Revoking approvals after the recovery phrase has leaked, instead of migrating immediately to a new wallet.
- Opening a revoke tool from a link sent in a comment or a direct message.
What do volume and data say here?
Approvals are recorded entirely on-chain, so you can inspect them yourself:
- Approval events: open your own address page in an explorer and look at the approvals section or Approval events. For each one, the token name, the spender address and the allowance limit are shown.
- Check the spender: click the spender address. An official contract usually has a name label, verified code and a long transaction history. A newly created contract with no label that is only a few days old is a big question mark.
- A drainer's footprints: if you see several assets leave your wallet one after another through transferFrom transactions that you did not send, one of your approvals has been abused.
This monthly review shows the real risk of your wallet; no app or dashboard replaces it.
📊 See real gold futures volume behind these ideas: free order flow course · today's gold volume map
Frequently asked questions
Can a wallet be hacked without the recovery phrase leaking?
Yes. By signing a malicious approval or Permit, the attacker gets permission to withdraw specific tokens without ever having your key.
How necessary is revoking approvals?
For a wallet that works with DeFi apps, regularly reviewing approvals and revoking unlimited and unused ones is among the most effective security steps. Each revocation costs a network fee.
What is EIP-7702 in plain language?
A feature of Ethereum that lets an ordinary wallet act like a contract by signing an authorisation. If that authorisation is given to a malicious contract, incoming assets are forwarded to the attacker automatically.
Education only, not a recommendation to buy or sell; we never give signals. Price examples are illustrative. Test any method on a demo account first, with strict risk management.