When you are about to click “Authorize,” the confirmation page will pop up an asset name, an authorization target, and a string of amounts. First, check the asset: is it the exact one you intend to use for this time? If you identify the asset incorrectly, the later checks become meaningless.
Suppose you want to use a certain asset to perform an on-chain operation, but the page writes the authorization target as a contract address you haven’t verified, and the amount shown is “Unlimited.” Next, check the target: does it correspond to the official process for the current operation, rather than being trusted just because the website name looks the same? Finally, check the amount—make sure it doesn’t exceed what you need for this specific use.
In common token approval models, once an amount is granted, the target can continue to call within the approved range until the allowance is used up or the permission is revoked. This does not mean that only a single transaction will be used this time. Also, an approval signature is not the same as having understood the permissions.
If you find anything you can’t understand on the confirmation page, the target doesn’t match, or the amount is clearly too large, cancel. Copy the full asset name, the complete identity of the authorization target, and the amount into one line, then go back to the current official documentation and compare each item one by one. Only continue when all three match.
Suppose you want to use a certain asset to perform an on-chain operation, but the page writes the authorization target as a contract address you haven’t verified, and the amount shown is “Unlimited.” Next, check the target: does it correspond to the official process for the current operation, rather than being trusted just because the website name looks the same? Finally, check the amount—make sure it doesn’t exceed what you need for this specific use.
In common token approval models, once an amount is granted, the target can continue to call within the approved range until the allowance is used up or the permission is revoked. This does not mean that only a single transaction will be used this time. Also, an approval signature is not the same as having understood the permissions.
If you find anything you can’t understand on the confirmation page, the target doesn’t match, or the amount is clearly too large, cancel. Copy the full asset name, the complete identity of the authorization target, and the amount into one line, then go back to the current official documentation and compare each item one by one. Only continue when all three match.