A smart contract token allowance is the amount of an ERC-20 token that you have authorized a specific address or smart contract to spend on your behalf.
For example, if you own 1,000 USDC and approve a decentralized exchange to spend 100 USDC, that exchange’s address has an allowance of 100 USDC. It can use transferFrom() to move up to that approved amount from your wallet, subject to the token contract’s rules. The ERC-20 standard defines the approve(), allowance(), and transferFrom() functions for this purpose.
A token allowance is not the same as sending tokens. When you approve an allowance, you authorize a spender to use a specified amount of your tokens later.
How Does a Token Allowance Work?
ERC-20 token allowances generally involve three functions:
approve()allowance()transferFrom()
The basic process is:
Token owner → approves spender → spender receives allowance → spender uses transferFrom()
Ethereum’s ERC-20 documentation describes approve() as setting the amount a spender can transfer from the token owner’s balance, while allowance() returns the remaining amount the spender is allowed to use.
Simple Example
Imagine you have:
1,000 USDC
You connect your wallet to a decentralized exchange and approve its token contract to spend:
100 USDC
Your allowance is now:
100 USDC
If the approved spender later uses 40 USDC through transferFrom(), the remaining allowance will generally become:
60 USDC
The ERC-20 mechanism deducts the amount spent from the allowance.
What Is approve() in ERC-20?
The approve() function gives a specific spender permission to transfer a specified amount of your tokens.
The basic structure is:
approve(spender, amount)
For example:
approve(DEX_ADDRESS, 100 USDC)
This tells the token contract that the specified spender is authorized to use up to that amount.
The ERC-20 specification defines approve() as allowing a spender to withdraw tokens from the owner’s account up to the approved amount.
Importantly, approving tokens does not itself transfer those tokens.
It changes the allowance recorded by the token contract.
What Is allowance()?
The allowance() function lets you check how many tokens an owner has authorized a particular spender to use.
It follows this structure:
allowance(owner, spender)
For example:
allowance(Alice, DEX)
could return:
500 USDC
That means the DEX address currently has permission to spend up to 500 USDC from Alice’s wallet, assuming the other conditions required by the token contract are satisfied.
Ethereum’s documentation describes allowance() as a read-only function that returns the remaining number of tokens a spender can use on behalf of an owner.
What Is transferFrom()?
transferFrom() is the function that allows an authorized spender to actually move tokens using an allowance.
A simplified version looks like:
transferFrom(owner, recipient, amount)
For example:
transferFrom(Alice, DEX, 100 USDC)
If the DEX is authorized to spend at least 100 USDC from Alice’s wallet and Alice has enough tokens, the token contract can transfer those tokens.
The ERC-20 specification defines transferFrom() as transferring tokens from one address to another using the allowance mechanism.
Token Allowance Example
Suppose Bob has:
10 ETH
and:
5,000 USDC
Bob wants to use a decentralized exchange to swap some USDC for ETH.
The DEX needs a way to move Bob’s USDC into the swap contract.
Bob may first approve the DEX to spend:
1,000 USDC
The process looks like this:
Step 1: Bob Connects His Wallet
The DEX identifies Bob’s wallet address.
Step 2: Bob Approves the Token
Bob signs an ERC-20 approve() transaction.
He approves:
1,000 USDC
Step 3: Allowance Is Recorded
The USDC token contract records that the designated spender can use up to 1,000 USDC from Bob’s address.
Step 4: Bob Executes the Swap
The DEX uses transferFrom() to move the required USDC.
Step 5: Allowance Changes
If 300 USDC is spent, the remaining allowance may become:
700 USDC
The exact behavior depends on the token implementation, but this is the standard allowance model.
Why Do Smart Contracts Need Token Allowances?
A smart contract cannot simply take ERC-20 tokens from your wallet because you interacted with it.
The token contract uses an authorization mechanism to determine which address can transfer tokens from another address.
The allowance system makes this possible.
For example, a DEX can ask:
“Please authorize this contract to spend up to X amount of your tokens.”
After the user approves, the DEX can use transferFrom() according to the token contract’s allowance rules.
Ethereum’s documentation specifically uses a DEX example where a user approves the DEX contract to spend tokens before the contract uses transferFrom() to receive them.
Token Allowance vs Token Balance
These two concepts are different.
| Concept | Meaning |
|---|---|
| Token balance | How many tokens you own |
| Token allowance | How many of your tokens a particular spender is authorized to use |
approve() |
Sets or changes the allowance |
allowance() |
Checks the allowance |
transferFrom() |
Uses the allowance to transfer tokens |
Example
You could have:
Wallet balance: 10,000 USDC
DEX allowance: 500 USDC
This means you own 10,000 USDC, but that particular spender is authorized to use only 500 USDC through the allowance mechanism.
Another spender could have a completely different allowance.
Does a Token Allowance Give a Smart Contract Access to Your Entire Wallet?
No, not automatically.
An ERC-20 allowance applies to a specific token contract, owner, and spender.
For example, if you approve a DEX to spend 100 USDC, that allowance does not automatically give it permission to spend your ETH or every other token in your wallet.
However, if you approve a spender for a very large amount of a particular token—or an effectively unlimited amount—it may be able to use that approved token allowance according to the token contract’s rules.
This is why users should pay attention to what they are approving.
What Is an Unlimited Token Allowance?
An unlimited token allowance is an approval that gives a spender permission to use an extremely large amount of a token, rather than approving only the amount needed for a specific transaction.
Some applications request very large allowances to avoid asking users to approve the same token repeatedly.
For example, instead of approving:
100 USDC
a wallet may show an approval for a very large maximum value.
The advantage is convenience: future transactions may not require another approval transaction until the allowance is reduced or exhausted.
The security trade-off is that a malicious or compromised spender could potentially use the remaining approved allowance.
Therefore, unlimited approvals deserve particular attention.
Is It Safe to Approve a Smart Contract?
It depends on what you are approving and which address you are approving.
A token approval gives the specified spender permission to use tokens from your address through the allowance mechanism.
If the approved contract is malicious, compromised, or has a vulnerability that allows unauthorized token transfers, an allowance can create a path for your approved tokens to be taken.
This is why you should verify:
- The website you’re using
- The token contract
- The spender address
- The amount being approved
- Whether an unlimited approval is necessary
The ERC-20 standard itself defines the allowance mechanism; it does not guarantee that every spender you approve is trustworthy.
What Is a Token Approval Scam?
A token approval scam is a type of crypto scam in which a user is tricked into approving a malicious or unwanted spender.
For example, a fake website may tell you:
“Approve this transaction to claim your reward.”
If you sign an approval transaction, the malicious spender may receive permission to transfer certain tokens from your wallet.
The approval transaction itself may not transfer your tokens immediately.
The danger is that it can create permission for the spender to transfer them later.
Can a Smart Contract Drain Tokens After Approval?
Potentially, if you have granted that spender sufficient allowance and the contract can legitimately invoke the token’s transfer mechanism.
For a standard ERC-20 allowance, the spender can use transferFrom() within the approved amount, assuming the token contract’s other conditions are satisfied.
This is why an old, unnecessary, or malicious token approval can represent a security risk.
However, an approval does not give the spender your private key or control over your entire wallet.
What Happens When You Revoke a Token Allowance?
When you revoke an allowance, you change the permission granted to the spender.
A common approach is to set the allowance to:
0
For example:
Current allowance: 1,000 USDC
After revoke: 0 USDC
The spender can no longer use that ERC-20 allowance to transfer tokens from your address, assuming the token follows the standard allowance mechanism.
The ERC-20 approve() function can be called again to set a new allowance.
Does Revoking an Allowance Cost Gas?
Usually, yes.
Changing an ERC-20 allowance changes blockchain state, so on Ethereum this normally requires an on-chain transaction and therefore a network fee.
The exact cost depends on the token contract, network, and current gas conditions.
If you’re revoking approvals on another EVM-compatible network, you generally pay that network’s native transaction fee rather than Ethereum mainnet gas.
How to Check Your Token Allowances
You can check allowances through tools that read the token contract’s allowance(owner, spender) value.
At a technical level, the token contract stores the relationship between:
Owner → Spender → Allowance
For example:
Alice → DEX A → 500 USDC
Alice → DEX B → 100 USDC
Alice → Lending Protocol → 2,000 USDC
Each spender can have a separate allowance.
Ethereum’s documentation explains that the allowance() function can be queried to determine how much a spender is authorized to use.
How to Revoke a Smart Contract Token Allowance
The general process is:
- Identify the token approval.
- Verify the spender address.
- Decide whether you still need the approval.
- Set the allowance to zero if you want to revoke it.
- Confirm the blockchain transaction.
- Wait for confirmation.
- Verify that the allowance is now zero.
Be careful when using third-party approval-management websites. Make sure you’re using a legitimate service and verify the transaction details before signing.
Token Allowance vs Token Approval
The terms token allowance and token approval are often used interchangeably, but they describe slightly different things.
Token Approval
The action of authorizing a spender, usually through the ERC-20 approve() function.
Token Allowance
The amount that the spender is currently authorized to use.
For example:
“I approved the DEX to spend my USDC.”
is describing the authorization action.
“My DEX allowance is 500 USDC.”
is describing the current permission amount.
Token Allowance vs Wallet Permission
These are also different.
A token allowance is generally specific to an ERC-20 token and a spender.
It does not give a dApp your private key.
It also does not automatically give the spender control over every asset in your wallet.
For example:
USDC allowance → USDC
DAI allowance → DAI
WETH allowance → WETH
Each token contract maintains its own allowance information.
What Is the ERC-20 Allowance Race Condition?
The original ERC-20 specification warns about a potential race condition when changing an existing allowance.
Suppose you have approved:
100 tokens
and want to change the allowance to:
200 tokens
The standard’s documentation notes that applications can mitigate the issue by first setting the allowance to zero and then setting the new allowance.
The reason is that transaction ordering can create situations where both the old and new allowances could potentially be used if the allowance is changed directly.
Modern token libraries and applications may use alternative allowance-management patterns, but users should still understand what an approval transaction is doing before signing it.
Why Do DEXs Ask for Token Approval?
A decentralized exchange often needs permission to move the tokens involved in a swap.
For example, if you want to swap:
1,000 USDC → ETH
the DEX’s relevant smart contract may need an allowance to spend your USDC.
The typical process is:
Approve USDC → DEX uses transferFrom() → Swap executes
Ethereum’s official tutorial demonstrates this approval-before-transferFrom() pattern in a DEX example.
Depending on the application and token, the approval may need to be completed before the actual swap transaction.
Why Does My Token Approval Say “Unlimited”?
Some dApps request a very large allowance so users don’t have to approve the same token repeatedly.
Instead of:
Approve 100 USDC
the application may request an allowance that is effectively unlimited.
This can make repeated transactions more convenient, but it also means the spender may have access to a much larger approved amount.
If you don’t need a large allowance, a smaller approval can reduce the amount exposed to that particular spender.
Does a Token Approval Transfer My Tokens?
No.
An approve() transaction normally changes the allowance recorded by the token contract.
It does not itself transfer the approved tokens.
For example:
Before approval:
10,000 USDC balance
0 USDC allowance
After approval:
10,000 USDC balance
1,000 USDC allowance
The tokens are still in your wallet.
The spender can then potentially use transferFrom() to move tokens within the authorized amount.
Does Token Approval Cost Gas?
Yes, an on-chain ERC-20 approval normally requires a blockchain transaction.
On Ethereum, that transaction consumes gas.
The cost depends on the token contract’s implementation, the amount of computation and storage involved, and current network conditions.
This is why a DEX swap can sometimes require two transactions:
- Token approval
- Swap
If you have already approved enough tokens for the relevant spender, you may not need another approval transaction for every subsequent swap.
Why Is My Token Allowance Not Working?
Several things can cause an allowance-related transaction to fail.
Insufficient Allowance
The spender is trying to transfer more tokens than the current allowance permits.
Insufficient Token Balance
You have enough allowance but not enough actual tokens.
For example:
Balance = 50 USDC
Allowance = 1,000 USDC
You still cannot transfer 100 USDC because you only own 50 USDC.
Wrong Spender
You approved one contract but the transaction is being executed by a different spender address.
Wrong Token
You approved USDC but are trying to spend DAI.
Allowance Was Revoked
The approval may have previously been set to zero.
Wrong Network
The approval exists on one network but you’re interacting with a contract on another.
Token Allowance Example With Numbers
Suppose Sarah owns:
5,000 USDC
She approves a DeFi protocol to spend:
1,000 USDC
Her state is:
| Item | Amount |
|---|---|
| USDC balance | 5,000 |
| Approved allowance | 1,000 |
| Remaining allowance | 1,000 |
The protocol spends:
300 USDC
Now:
| Item | Amount |
|---|---|
| USDC balance | 4,700 |
| Remaining allowance | 700 |
If the protocol tries to spend another:
800 USDC
the standard allowance mechanism would not permit that transfer based on a 700 USDC remaining allowance.
Ethereum’s ERC-20 implementation documentation describes transferFrom() as requiring the caller to have sufficient allowance and deducting the amount spent from that allowance.
Can Two Smart Contracts Have Different Allowances?
Yes.
An ERC-20 token tracks allowances by owner and spender.
For example:
| Spender | Allowance |
|---|---|
| DEX A | 500 USDC |
| DEX B | 1,000 USDC |
| Lending Protocol | 2,500 USDC |
| NFT Marketplace | 100 USDC |
These permissions are separate.
Revoking DEX A’s allowance does not automatically revoke DEX B’s allowance.
What Happens to Token Allowance After Spending?
For standard ERC-20 behavior, when transferFrom() spends tokens using an allowance, the allowance is reduced by the amount spent.
For example:
Allowance = 1,000 USDC
Spent = 250 USDC
Remaining = 750 USDC
Ethereum’s ERC-20 documentation describes this deduction as part of the allowance mechanism.
However, token implementations can have variations, so users should not assume every token behaves identically to a basic ERC-20 implementation.
Token Allowance Security Best Practices
To reduce unnecessary risk:
1. Verify the Spender
Before approving tokens, make sure you know which address you’re authorizing.
2. Avoid Blindly Approving Unlimited Amounts
If an application only needs 100 tokens, consider whether a smaller allowance is sufficient.
3. Revoke Unused Approvals
If you no longer use a protocol, consider revoking unnecessary token allowances.
4. Check What You’re Signing
Don’t approve a transaction simply because a website says you need to.
5. Use the Correct Website
Phishing websites can imitate legitimate DeFi applications and request malicious approvals.
6. Separate Important Funds
Consider keeping long-term holdings separate from wallets used frequently with DeFi applications.
7. Review Old Approvals
Old allowances can remain until they are changed, revoked, or otherwise reduced by token-contract behavior.
Frequently Asked Questions
What is a token allowance in crypto?
A token allowance is the amount of an ERC-20 token that a specific spender is authorized to transfer from a token owner’s address. The ERC-20 standard uses approve(), allowance(), and transferFrom() for this functionality.
What does approving a token mean?
Approving a token means authorizing a specific spender to transfer up to a specified amount of that token from your wallet through the ERC-20 allowance mechanism.
Does approving a token mean I sent the tokens?
No. Approval normally changes the allowance. The tokens remain in your wallet until a permitted transfer occurs.
Can a smart contract take my tokens without approval?
For a standard ERC-20 allowance-based transfer using transferFrom(), the spender generally needs sufficient authorization from the token owner. However, token contracts can have other mechanisms or vulnerabilities, so users should understand the specific token and contract they’re interacting with.
Is unlimited token approval dangerous?
It can increase the amount of a token exposed to a particular spender if that spender is malicious or compromised. A smaller allowance can limit the amount that can be transferred through that approval.
How do I revoke a token allowance?
You generally revoke an allowance by setting the spender’s allowance to zero through an appropriate transaction.
Does revoking token approval delete my tokens?
No. Revoking an allowance changes the permission granted to the spender. It does not delete your tokens.
Does token approval cost gas?
Yes, an on-chain ERC-20 approval normally requires a blockchain transaction and therefore a network fee.
Why do I need to approve a token before swapping it?
The DEX or other smart contract may need permission to move your tokens using transferFrom(). Approval provides that permission.
Can a token allowance expire?
A standard ERC-20 allowance generally does not have a built-in expiration time. It normally remains until it is changed, reduced, revoked, or consumed according to the token’s implementation.
Is token allowance the same as token balance?
No. Your balance is how many tokens you own. Your allowance is how many of those tokens a particular spender is authorized to use.
Can I have different allowances for different dApps?
Yes. Each spender can have its own allowance for the same token.
What Is a Smart Contract Token Allowance? Key Takeaways
A smart contract token allowance is permission for a specific address or smart contract to spend a specified amount of your ERC-20 tokens.
The three main functions are:
approve()— gives or changes permission.allowance()— checks how much permission remains.transferFrom()— uses that permission to transfer tokens.
For example:
You own 1,000 USDC → approve a DEX for 500 USDC → the DEX can use up to 500 USDC through the allowance mechanism.
The approval itself does not transfer the tokens.
The most important security consideration is what address you’re approving and how much you’re approving. An unnecessary or unlimited allowance can expose more tokens to a particular spender than you intended.
In simple terms:
Token balance = what you own.
Token allowance = what a specific spender is allowed to use.
Token approval = the action that grants that permission.
