The reason this category catches experienced people is that the harmful action does not feel like an action. You approve something, the wallet closes, everything looks the same. The consequence arrives later — sometimes much later — and by then the moment that caused it has been forgotten.
A transfer and an approval are different things
A transfer moves an asset once, now. An approval grants a contract permission to move a token on your behalf later, repeatedly, at a time it chooses.
That is the whole distinction, and almost everything else follows from it. Approvals exist for a legitimate reason: a decentralised exchange has to be able to take the token you are selling at the moment you trade, so you authorise it in advance. The mechanism is normal. What is not normal is granting it to something that had no reason to ask.
The prompts for these two look similar in most wallets, and the labels are technical. The reliable question is not "what does this say" but "is this asking to do something once, or to be allowed to do something repeatedly".
"It didn't cost gas, so it wasn't risky"
This is the most expensive sentence in the subject
An off-chain signature can constitute a valid authorisation that the other side submits to the network themselves, whenever they choose. You paid nothing, no transaction appeared in your history, and nothing left your wallet at that moment.
From your side it was a click. From theirs, they now hold something they can use. The standardised mechanism for signing token permissions this way is described publicly in EIP-2612.
The absence of a fee is doing something specific here: it removes the moment of hesitation that paying normally creates. A prompt that costs money makes you look at it. A free one does not.
What an unlimited allowance actually means
Many applications request an unlimited allowance by default, and the stated reason is genuine: approve once and you never pay to approve again. The cost is that you have granted open-ended authority over that token to that contract, indefinitely.
The trade-off is situational rather than absolute. For a contract you use frequently and have reason to trust, unlimited is a reasonable convenience. For a site you are using once, or one you met ten minutes ago, set the specific amount you need — most wallets let you edit the figure, though the control is deliberately unobtrusive.
One clarification, because this area attracts overreaction: an unlimited allowance is not the same as being drained. The risk accumulates over time — a contract may later be found to have a flaw, or its permissions may be misused. The correct response is periodic housekeeping, not alarm.
The four fields worth reading
Read these, then decide
- The requesting domain. Shown by the wallet, not by the page. If it is not the site you believe you are on, stop.
- The action type. Transfer, approval, or signing structured data. A "claim" that turns out to be an approval is a mismatch between what the page says and what it does, and that mismatch is the conclusion.
- Who is being authorised. An address you have no relationship with is worth pausing on.
- The amount. Unlimited versus a specific figure, and whether that figure matches what you intended to do.
If any of the four is unclear, cancel. Cancelling costs nothing and a legitimate site will still be there in a minute.
Reviewing and revoking what you have already granted
Approvals persist. They do not expire when you close the tab, disconnect the wallet, or stop using the site. Anything you granted a year ago is still granted.
Block explorers publish approval-checking tools that list existing allowances for an address and let you revoke them — Etherscan's token approval checker is one, and equivalents exist for other networks. Wallet vendors document the process too; MetaMask's guidance on revoking allowances is a reasonable reference.
Two practical notes. Revoking is an on-chain transaction, so it costs a fee — budget for that rather than being surprised by it. And do the review per network: approvals granted on one chain do not appear when you look at another.
A sensible cadence is a review whenever you notice you have used something new, rather than a scheduled ritual nobody keeps. Revoke what you no longer use; reduce unlimited allowances on anything occasional.
If you have already signed something you are unsure about
Order matters, and most people get it wrong: move assets first, revoke second, investigate third.
Investigating first feels responsible and is the expensive choice, because the interval spent working out exactly what you signed is the interval in which it can be used. Moving valuables to a fresh wallet is reversible in cost and irreversible in benefit.
Then revoke the approvals on the original address. Then, with no time pressure, work out what happened, and check whether the same site asked you to sign more than once.
If the request came through an airdrop or claim page, the surrounding pattern is in the phishing pattern behind airdrop claim pages. If a seed phrase was entered anywhere at any point, that is a different and more final situation, covered in why a seed phrase must never be photographed.
Common questions
Signing costs no gas. Doesn't that mean it's harmless?
No, and this is the most common misunderstanding in the whole area. An off-chain signature can constitute a valid authorisation that the other party submits themselves later. You spent nothing and nothing left your wallet at that moment, which is exactly why there is no sense of loss to warn you.
What is the difference between a transfer and an approval?
A transfer moves an asset once, now. An approval grants a contract permission to move a token on your behalf later, repeatedly, at a time it chooses. The prompts look similar and the second one is frequently the cheaper of the two to sign.
Is an unlimited allowance always a bad idea?
Not always. For a contract you use often and trust, it avoids re-approving every time. The cost is that you have handed over open-ended spending authority for that token. For a site you are using once, set a specific amount instead — most wallets allow editing the figure, though the control is not prominent.
Which fields should I read in a signature prompt?
Four: the domain making the request, the type of action, who is being authorised, and the amount. If any of the four is unclear, cancel. Cancelling costs nothing, and a legitimate site will still be there afterwards.
I already signed something. What do I do first?
Move assets before investigating. Transfer anything of value to a fresh wallet, then revoke approvals, then work out what happened. Many people reverse this and spend the critical window researching rather than moving.