ERC-20 and approve: why the “approval” and what unlimited means

When you deposit USDT or USDC into a deal, the wallet asks for two signatures: first an "approval", then the deposit itself. It confuses beginners: why two? The answer lies in how tokens work.

What an ERC-20 token is

The network's main coin (ETH) is built into the protocol: the network itself can transfer it. A token is a contract: a simple program with an "address → balance" table. ERC-20 is the standard for such a program; it has a set of functions: balanceOf, transfer, approve, transferFrom and a few more. Thanks to the common standard, wallets and apps can work with thousands of tokens the same way.

An important consequence: when you "send USDT" you are actually calling a function in the token contract, and it changes the numbers in its own table. The transferred coins do not "lie" in the wallet - the wallet only holds an entry in the token's table.

Why you cannot just send tokens to a contract

When you send tokens to a smart contract with a plain transfer, the receiving contract does not learn about the arrival: its code is not called. The money just ends up at the address and the contract cannot tie it to a deal. So another path is needed: let the contract take the tokens from you itself at the moment the deal is created.

That is what the two-step mechanism is for:

1. approve(spender, amount) - you allow the address spender (the deals contract) to take up to amount tokens from you. The money stays with you. Only the "allowed to such-and-such this much" entry changes (the allowance).
2. transferFrom(owner, to, amount) - the deals contract calls this function and takes exactly the amount you allowed and the deal needs.

Two steps - two signatures. The first spends nothing, the second performs the deposit.

Exact amount or unlimited

When approving you are offered two options.

Exactly this amount. The contract can take only the deal amount and after the deposit the approval drops to zero. Safer: if the contract is ever compromised it cannot reach your other money. The downside is a separate signature for each next deal.

Without limit. A huge number is written into the amount field (usually 2^256 − 1). More convenient: later deals need no approval. But the contract gets the ability to spend any amount at any moment.

A common scam

Attackers do not hack the token itself - they ask you to grant an approval to their address. "Sign to get an airdrop", "verify your wallet". You sign an approve for a huge amount - and the scammer takes your tokens with their transferFrom whenever they wish. The wallet spent nothing at the moment of signing, so there is no sense of danger.

Signs: an approval request from an unknown address; the amount is "unlimited"; the context is unrelated to your actions.

How to check and revoke approvals

All granted approvals are public. You can check them:

• in a block explorer - "Token Approvals" sections or similar;
• in dedicated revoke services;
• in the wallet itself (some show a list).

To revoke, sign a new approve with the amount 0 - it costs a small fee but zeroes the access. Do it periodically, especially for long-unused services.

The USDT quirk on Ethereum

USDT on Ethereum has an unusual safeguard: to change an existing non-zero approval to another non-zero one, you must first reset the old one to zero. So if you have a partial approval left, you need three signatures instead of two: reset, new approval, deposit. The interface warns you in advance.

On other tokens and networks this restriction is usually absent. More on token quirks in the article on non-standard tokens.

Alternatives: permit and Permit2

There are extensions that let you skip the separate approve transaction: you sign a message (free, off-chain) and the contract uses it in the same transaction. It saves gas and steps. Not all tokens support it, so the classic approve + transferFrom pair remains the most compatible.

Summary

• A token is a table of balances in a contract, not "coins in a wallet".
• approve does not spend money, it gives the right to spend.
• An exact amount is safer than unlimited.
• Do not grant approvals to unknown addresses.
• Periodically check and revoke old approvals.

What to read next

Approvals are scammers' favourite target. Reinforce what you learned in the wallet security checklist and in the analysis of attacks: phishing and address poisoning. Everything you sign stays on the blockchain forever, and it can be studied: how to read Etherscan.