A token approval (also called an allowance) is a transaction by which you give a smart contract the right to move a specific token from your wallet up to a certain amount. It is a necessary part of many ERC-20 and similar-standard operations: for example, when you swap tokens on a decentralised exchange or connect a wallet to a Web3 service, the contract asks for an approval first.
Why it is a security issue
An approval stays valid even after you have left the site. Many interfaces ask by default for an unlimited approval so that you do not have to confirm each time. If the contract is malicious or is hacked later, it can take your tokens without a new signature. So-called drainer scams are built on exactly this: a fake "airdrop", "bonus" or "account verification" asks you to sign a transaction that is actually an approval for the attacker's contract.
How a casino player encounters it
- An ordinary casino deposit does not need an approval. You send the token to the casino's address as a normal transfer. If a "deposit" asks you to sign an approve transaction, stop and check where you are.
- Casinos with Web3 login may ask you to connect a wallet and sign a message. Signing a message to log in is normal; a token approval to log in is not.
- Suspicious links on social media and in chats are the main source of malicious approvals.
How to protect yourself
- Read in the wallet's confirmation window what you are signing. The words "approve", "allowance", "setApprovalForAll" or "permit" mean an approval.
- If an approval is needed, limit the amount to what you will actually use.
- Use a separate small hot wallet for play and keep a larger amount in a cold wallet that never connects to any site.
- Review and revoke old approvals from time to time. For Ethereum this can be done for example with Etherscan's token approval tool; revoking is itself a transaction and costs a gas fee.
If you signed a wrong approval
Revoke the approval immediately and move the remaining tokens to a new wallet whose seed phrase has never been online. Tokens already taken cannot be reversed. Report the case to the police and keep the TXIDs. Safe behaviour is gathered in the guide crypto casino security. Technical background: ethereum.org security.