The first time you use a DeFi app, your wallet will ask you to approve something before the real action happens. That popup is easy to click through — but it is not a formality. It is you handing a smart contract a key that says: you may move this token out of my wallet, up to this limit.
What an approval actually is
On most DeFi chains, tokens do not leave your wallet unless you sign a transaction. But a lending pool cannot pull your USDC into a loan unless you have already said it may.
An approval records that permission on the blockchain:
| Piece | Plain-English meaning |
|---|---|
| Your wallet | Still holds the tokens — until the contract uses the approval |
| The contract | The DeFi app’s on-chain program (lending pool, swap router, etc.) |
| The amount | How much the contract is allowed to move — exact number or “unlimited” |
| The token | Which coin you are granting access to — USDC, ETH, DAI, etc. |
Think of it like giving a valet a ticket that says they may take your car from the garage — but only up to a mileage limit, and only that one valet company. The car stays yours until they actually drive it.
Why DeFi apps need them
Blockchains process one transaction at a time. A swap app cannot quietly reach into your wallet on every trade. The usual pattern is two steps:
- Approve — grant the swap contract permission to touch your USDC
- Swap / deposit / lend — the contract uses that permission to pull the amount you asked for
You will see this when you:
- Swap on a decentralized exchange
- Deposit into a lending protocol
- Stake or farm by sending tokens into a reward contract
- Bridge through some interfaces (the bridge contract needs access first)
The approval is separate from the action itself. That is why beginners sometimes sign twice and wonder what the first popup was for.
Unlimited vs exact amounts
Many apps default to an unlimited (or “max”) approval so you only approve once and never see the popup again for that token.
| Type | Upside | Downside |
|---|---|---|
| Exact amount | Contract can only take what you need right now | You may approve again on the next visit |
| Unlimited | One click, smoother repeat use | If the contract is exploited, all of that token in your wallet is at risk |
Unlimited approvals are a convenience trade-off, not a free feature. Major protocols get hacked. Smaller or copycat sites get hacked more often. A leftover unlimited approval to a dead farm is a forgotten key under the doormat.
When your wallet or the app offers “approve exact amount,” that is usually the safer choice — especially for sites you use once or do not fully trust yet.
What to check before you approve
Before you click confirm:
- Which site asked? Bookmark official URLs. Phishing sites copy real interfaces and ask for approvals to their contracts.
- Which token? Approving USDC is not the same as approving ETH. Read the symbol.
- Which amount? If it says unlimited or a number far larger than your deposit, pause.
- Do you still use this app? Old approvals do not expire on their own.
You can revoke approvals you no longer need. Tools like revoke.cash (always type the URL yourself or use a bookmark) show open permissions and let you close them. Revoking costs a small gas fee — worth it after experimenting on random protocols.
Approvals are not the same as connecting
Connect wallet shares your public address so a site can build transactions. It does not, by itself, let anyone move your tokens.
Approve is an on-chain permission tied to a specific contract and token. Until you revoke it, that contract can pull funds within the limit you set — even if you never visit the website again.
Both popups deserve a glance. Connecting to a fake site is bad. Approving a fake contract is worse.
Treat every approval like handing someone a spare key. Use exact amounts when you can, revoke permissions you no longer need, and never approve tokens on a site you reached through a DM, an ad, or a URL you did not verify yourself.