Infinite Approval

How It Works

When a DeFi application requests an infinite approval, it sets the allowance to the maximum possible value — typically 2^256 - 1 (an astronomically large number). This means the approved contract can spend any amount of that token from your wallet, now or at any point in the future, without requiring another approval transaction.

DeFi protocols request infinite approvals because each approval transaction costs gas. By approving an unlimited amount upfront, users only pay the gas fee once, even if they perform dozens or hundreds of subsequent transactions with that contract. On Ethereum mainnet, where gas fees can be significant, this saves real money over time.

Most modern wallet interfaces (MetaMask, Rabby, Phantom) now display the requested approval amount and let you edit it to a custom value before signing. This allows users to choose between the convenience of infinite approvals and the security of exact-amount approvals.

Why It Matters in DeFi

Infinite approvals are the single largest attack surface for DeFi wallet exploits. If an approved contract is later compromised through a security vulnerability, the attacker can drain all approved tokens — not just the amount you originally intended to use. Major exploits like the Badger DAO attack ($120 million) and various phishing campaigns have exploited lingering infinite approvals.

Security-conscious traders limit approvals to the exact amount needed per transaction and regularly revoke unused approvals. While this costs more gas, it significantly reduces the blast radius of any single contract compromise.

Real-World Example

A trader approves Uniswap's router for infinite USDC spending, then swaps 500 USDC. Months later, a hypothetical vulnerability in the router contract is discovered. Because the infinite approval is still active, an attacker exploiting that vulnerability could drain the trader's entire USDC balance — not just the 500 USDC originally swapped. Had the trader approved only 500 USDC, the exposure would have been limited to zero (since those tokens were already spent).