SignLens

Warnings › Spending rights

Token approvals: someone else may spend from your account

Published

The token program's Approve names a delegate who may spend from one of your token accounts, up to an amount, at any time and without asking you again. It has legitimate uses; a drainer asks for the largest amount there is, 18,446,744,073,709,551,615 raw units, and empties the account whenever it likes.

Nothing leaves your wallet when you sign an approval, so a balance preview shows nothing. In the November 2025 owner-change case, the victim's transactions also approved that amount on eight token accounts to the attacker, inside a program of the attacker's own (the case).

What SignLens shows

The delegate, the account and the amount, with "UNLIMITED" spelled out, and a high finding. A constructed example:

Warning

Allow DbRK…ERgS to spend UNLIMITED USDC from ARX9…Evfz

What SignLens found

What this does

Full text, as the engine prints it
Allow DbRK…ERgS to spend UNLIMITED USDC from ARX9…Evfz
WARNING: review the findings before approving

Findings:
  [HIGH] Lets DbRK…ERgS spend an UNLIMITED amount from this token account at any time (instruction 1)

== Approve delegate | Token program
  Token account: Your token account (ARX9…Evfz)
  Delegate: DbRKJvepcS1YEmpBNX3Kc67kjQmyMm3RYovaAVk9ERgS
  Up to: UNLIMITED USDC
  Owner: Your wallet (BqHR…Tx9A)

== Signers
  Fee payer: Your wallet (BqHR…Tx9A)

== Fee
  Total: 0.000005 SOL
  Base: 0.000005 SOL

== Validity
  Expires: in about a minute (recent blockhash)

Effects:
  - Allow DbRKJvepcS1YEmpBNX3Kc67kjQmyMm3RYovaAVk9ERgS to spend UNLIMITED USDC from Your token account (ARX9…Evfz)
  - You pay a fee of 0.000005 SOL
  - Valid for about a minute (recent blockhash)

Raw: solana legacy (180 bytes)
  digest: 85f43ca48dec2e558396d4613abe7eba98161fb49c09b5c442199ec817c10208
A constructed transaction, built to show this case; it was never sent. Explained for BqHR…Tx9A as the signer, by the SignLens engine 0.3.0, on 2026-11-01. How to read this.

The plain Approve instruction names the account, not the token. Here the account is the signer's own USDC account, which SignLens can tell from its address, so it names USDC; of an account it cannot place, it says only that it is the token held there, rather than guess. Where a dapp uses ApproveChecked, the instruction names the token itself.

What to do

Approve only what an order needs, to a program you recognise, and revoke approvals you no longer use.

Other warnings: accounts given away, signatures that never expire, lookalike addresses, programs it does not know, multisig approvals you cannot see, a swap paying someone else.

Try it: install SignLens for Chrome or Firefox.

Sources