imtoken Knowledge Center
Token Approval Security
An approval defines how much a contract may spend under certain conditions, so the spender, allowance and duration deserve separate review.
Connection is not authorization
A DApp connection creates a communication channel between a site and a wallet. It does not automatically authorize assets or make later signature requests safe. In the context of Token Approval Security, the practical goal is to understand what the wallet is showing, what the network is recording, and which details must be verified before you approve an action.
A useful check is to separate interface information from on-chain facts. Review the active network, address, transaction hash, contract or permission scope as relevant, and avoid assuming that a familiar symbol or screen guarantees the intended result.
Read every signature request
Message signatures, transaction signatures and token approvals have different consequences. Before confirming, review the requester, network, amount, contract and permission scope. In the context of Token Approval Security, the practical goal is to understand what the wallet is showing, what the network is recording, and which details must be verified before you approve an action.
A useful check is to separate interface information from on-chain facts. Review the active network, address, transaction hash, contract or permission scope as relevant, and avoid assuming that a familiar symbol or screen guarantees the intended result.
Token approvals and contract permissions
Third-party smart contracts may carry code, permission or governance risk. After use, disconnect sessions you no longer need and review persistent approvals. In the context of Token Approval Security, the practical goal is to understand what the wallet is showing, what the network is recording, and which details must be verified before you approve an action.
A useful check is to separate interface information from on-chain facts. Review the active network, address, transaction hash, contract or permission scope as relevant, and avoid assuming that a familiar symbol or screen guarantees the intended result.
Clean up permissions after use
A DApp connection creates a communication channel between a site and a wallet. It does not automatically authorize assets or make later signature requests safe. In the context of Token Approval Security, the practical goal is to understand what the wallet is showing, what the network is recording, and which details must be verified before you approve an action.
A useful check is to separate interface information from on-chain facts. Review the active network, address, transaction hash, contract or permission scope as relevant, and avoid assuming that a familiar symbol or screen guarantees the intended result.
- Verify the active network and destination before confirming.
- Treat seed phrases and private keys as secret credentials.
- Review DApp, signature and approval requests independently.