Token Approvals and Permit2 Signatures: How to Swap on a DEX Without Leaving the Door Open

Most people who use a decentralized exchange think about price, slippage and gas. Far fewer think about what they leave behind after the swap is done. Every time you trade an ERC-20 token on a DEX, you grant a smart contract permission to move that token from your wallet. Those permissions often stay active long after you have forgotten about them, and they are one of the most common ways wallets are drained. This guide explains how token approvals and Permit2 signatures work, and how to keep them under control.

Why a swap needs an approval at all

ERC-20 tokens do not let a contract pull funds from you unless you have first called approve, setting an “allowance” for a specific spender. As the Uniswap help center explains, the first time you swap or add liquidity with a token, you must approve it so the protocol can move it from your wallet. Many interfaces suggest an unlimited allowance to save you gas on future trades. That is convenient, but it means the spender can move your entire balance of that token, today or years from now.

What Permit2 changes

Uniswap’s Permit2 contract introduced a two-step model. First you make a one-time on-chain approval of a token to the Permit2 contract. After that, individual apps get permission through an off-chain signature that names the spender, the amount and an expiry. According to Uniswap’s Permit2 explainer, the Uniswap app uses a 30-day signature approval, after which you are asked to sign again.

This is a real improvement: permissions can expire, and apps no longer need their own unlimited allowance. The trade-off is that a signature costs nothing and creates no transaction, so it is easy to sign without thinking. Uniswap itself warns that any token approved to Permit2 is vulnerable to a malicious signature, for example a fake “sign in to verify your wallet” prompt. The MetaMask help center adds that attackers may wait days or weeks before using a stolen signature, which makes it hard to work out which site was responsible.

Before you sign: a 30-second check

• Domain: type the DEX address yourself or use a bookmark. Do not follow links from direct messages, ads or reply threads.
• Network: make sure the chain in your wallet matches the chain you intend to trade on.
• Spender and token: modern wallets decode Permit2 messages. Check that the token is the one you are selling and that the spender is the app’s known router, not an unfamiliar address.
• Amount and expiry: a swap of 500 USDC should not need a permit for your entire balance with an expiry years away.
• Context: logging in, claiming an airdrop or “verifying” a wallet never requires a token permit. If a site asks for one in that situation, close the tab.

Auditing your existing approvals

Disconnecting a wallet from a website does not remove its approvals; the allowance lives on-chain. To see what you have granted, use the token approval checker on the block explorer for your network (Etherscan for Ethereum, and the equivalents for Arbitrum, Base, Optimism, Polygon and others), or a dedicated tool such as revoke.cash, which MetaMask also recommends. Connect your wallet in read mode and review the list.

Prioritize revoking:

1. Unlimited allowances to contracts you no longer use.
2. Approvals to protocols that have been exploited, deprecated or migrated to a new version.
3. Approvals for tokens with large balances, especially stablecoins.
4. Anything you do not recognize.

Each revocation is an on-chain transaction, so it costs gas. On layer-2 networks this is usually cheap; on Ethereum mainnet it is worth batching your clean-up into a quiet, low-fee period.

Revoking Permit2 permissions specifically

Permit2 has two layers. The first is the token’s allowance to the Permit2 contract itself, which you can set to zero like any other approval. The second is the set of downstream permissions stored inside Permit2 for individual spenders. The contract includes a lockdown function that resets those stored allowances to zero for chosen token and spender pairs, and approval tools increasingly show Permit2 entries separately. If you suspect you signed something malicious, setting the token’s allowance to Permit2 to zero cuts off every downstream permit at once.

When revoking is too slow

If you believe a signature or approval is already being exploited, a revoke transaction can lose the race against an attacker’s transfer. In that case MetaMask’s guidance is to move at-risk tokens to a fresh address, since approvals and permits apply only to the account that granted them. Make sure the new wallet is created on a clean device if there is any chance the old one was compromised.

Habits that keep risk low

Use a separate “hot” wallet for swapping with only the funds you need for active trading, and keep long-term holdings in a wallet that never signs DeFi approvals. Prefer exact-amount approvals when the interface allows it. Review your approvals monthly, the same way you would check a bank statement. These steps take minutes and remove one of the most common reasons people lose funds on DEXs.

Disclaimer: This article is for general information and education only and is not financial or security advice. Smart contracts and wallets carry risk, and you are responsible for verifying every transaction you sign.