Old Token Approvals Remain Active, Putting Holders at Risk

Decentralized exchanges, lending pools, and bridges often require token approvals to facilitate transactions. However, these approvals can remain active even after the initial transaction is completed.

The ERC-20 standard, which governs most tokens on Ethereum, does not include an expiration date for approvals. This means that once an approval is granted, it will stay in place until manually revoked by the token holder.

Unlimited approvals can be particularly problematic, as they allow a contract to pull out the entire balance of a token without further permission. In recent weeks, there have been cases where users lost funds due to compromised contracts or manipulated signature requests from wallet drainers.

A measurement carried out by cryptoticker.io on September 14, 2026, found that 13.9% of newly granted approvals for the top five ERC-20 tokens (USDT, USDC, DAI, WETH, and LINK) were set to unlimited. The same analysis revealed that revoking a single approval costs approximately 0.52 cents in gas fees.

This is not a new issue, but rather one that has been ongoing for years. Previously, the high cost of revoking approvals was cited as a reason to leave them active, but with current gas prices, this is no longer a valid excuse.