Token approval

The mechanism rests on three ERC-20 pieces, introduced in November 2015 with EIP-20. The approve(spender, amount) function sets a maximum amount, the allowance, that the authorized address may withdraw. The allowance mapping records the remaining permission on-chain. And transferFrom moves the tokens, consuming that allowance. It is the usual first step in DeFi: to run a swap, deposit into a pool or lend, the contract needs authorization to move your tokens.

Understanding it matters because it is the basis of on-chain composability and, at the same time, a sensitive point of operational security. Many applications request an unlimited approval (the uint256 maximum) to avoid repeating the step, convenient but risky. Off-chain signature variants reduce that exposure: EIP-2612 (permit) approves via a signed message with nonce and deadline, and Uniswap's Permit2 centralizes short-lived permissions with amount and expiry. Best practice is to approve only what is needed and review unsolicited signatures.

In practice, USDC and DAI implement EIP-2612, Uniswap uses Permit2, and tools like revoke.cash let users audit and revoke active allowances. For any organization running on-chain treasury in the EU, periodically reviewing granted approvals is an internal-control routine as basic as reconciling accounts, and it fits the custody requirements that MiCA places on crypto-asset service providers.