Approvals exist so applications can move tokens for you without holding your key. An approval is often unlimited in amount and open-ended in time, and it survives long after you have closed the site.
This is the mechanism behind most drainer incidents. The withdrawal can happen days later, from a wallet whose key was never compromised. Revoking outstanding approvals, then moving remaining funds to a fresh wallet, is the correct order of operations.
Related terms
Wallet drainer
A malicious contract or site designed to obtain signatures that let it withdraw a victim's tokens.
Smart contract
Code deployed to a network that executes automatically when called, with no ability to intervene mid-way.
Approval revocation
Cancelling a permission you previously granted a contract, so it can no longer move your tokens.
Guides that use this term
Trying to work out what happened to your funds?
The first review is free and we set out scope and price in writing before any paid work.