Approvals and permissions: what you sign in DeFi

What an approval actually is

An approval is an authorisation.

It gives a smart contract the right to act on your behalf under specific conditions. It does not move funds by itself. Instead, it changes who is allowed to move them later, and that change takes effect the moment you confirm.

From the blockchain's perspective, this is a valid state change like any other. Once recorded, it becomes part of the shared history. Nothing about it expires unless the permission itself was explicitly limited, and most are not.

For a deeper understanding of the systems that receive these permissions, see Smart contracts: what they are and why they matter.

Permissions that persist

Many approvals remain active indefinitely. Once granted, they stay in place until deliberately revoked. Revocation requires a separate transaction, initiated by the user.

In practice, this means that future interactions with a contract may proceed without asking for confirmation. The contract can act on previously granted authority, at any point, without a new prompt. If a protocol is no longer being used, the permission remains. The blockchain simply enforces it when invoked.

If you want to review or remove permissions that are no longer needed, see How to revoke approvals safely.

Why approvals feel different from transfers

Transfers feel final because something visible happens immediately. Balances change. The action and its consequence arrive together.

Approvals separate the two. The action happens now. The consequence may appear much later, or never, if the permission is never used. That gap makes approvals easier to overlook, and harder to connect to outcomes that occur weeks or months afterward.

The system treats an approval with the same finality as a transfer. Both are irreversible state changes. The only difference is when the effects become visible.

Scope and assumptions

Not all approvals are equal.

Some grant access to a specific amount, for a specific contract. Others grant broad or unlimited access. The interface you use may not make that distinction obvious, and users often assume that an approval is narrowly scoped to the interaction at hand.

What gets enforced is exactly what was authorised, no more and no less. A broad approval granted once remains broad until revoked. Understanding what you are signing matters more than trusting that it will be limited by default.

Revocation and awareness

Permissions do not expire on their own. Revoking one requires a deliberate action, a separate transaction that explicitly removes the authorisation.

Permissions tend to accumulate over time. Many remain active long after the interaction that created them has been forgotten. There is no notification when a permission is used, and no reminder that an old approval is still valid. The blockchain records them accurately and enforces them silently.

The gap between what was signed and what is still active is entirely outside the system's concern.