{"id":494,"date":"2021-10-26T04:16:15","date_gmt":"2021-10-26T04:16:15","guid":{"rendered":"https:\/\/MrRealFi.com\/?p=494"},"modified":"2021-10-26T04:16:16","modified_gmt":"2021-10-26T04:16:16","slug":"limit-token-allowances","status":"publish","type":"post","link":"https:\/\/MrRealFi.com\/limit-token-allowances\/","title":{"rendered":"How to Limit Token Allowances on Metamask Wallet"},"content":{"rendered":"\n<p>Since smart contract hacks are incredibly common these days, it is important that you set up your own line of defense to minimize risk.<\/p>\n\n\n\n<p><strong>The first thing you can do is limit smart contract approval. <\/strong><\/p>\n\n\n\n<p>If you have participated in a DeFi protocol then you have already given smart contracts access to spend your wallet&#8217;s funds.<\/p>\n\n\n\n<p>By default, the approval is set to unlimited for convenience&#8217;s purposes.<\/p>\n\n\n\n<p>This is not a great idea because malignant smart contracts may exploit the default setting to drain your wallet dry. <\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_17 counter-hierarchy ez-toc-grey\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\">Page Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class=\"ez-toc-list ez-toc-list-level-1\"><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#Smart_Contract_Hacks_in_2021\" title=\"Smart Contract Hacks in 2021\">Smart Contract Hacks in 2021<\/a><ul class=\"ez-toc-list-level-3\"><li class=\"ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#1_Furucombo\" title=\"1. Furucombo\">1. Furucombo<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#2_Cream_Finance\" title=\"2. Cream Finance\">2. Cream Finance<\/a><\/li><\/ul><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#Why_You_Should_Change_the_Default_Setting_on_Your_Wallet\" title=\"Why You Should Change the Default Setting on Your Wallet\">Why You Should Change the Default Setting on Your Wallet<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#Step-by-step_Guide_on_How_to_Limit_Smart_Contracts_Approval\" title=\"Step-by-step Guide on How to Limit Smart Contracts Approval\">Step-by-step Guide on How to Limit Smart Contracts Approval<\/a><ul class=\"ez-toc-list-level-3\"><li class=\"ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#Step_1\" title=\"Step 1:\">Step 1:<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#Step_2\" title=\"Step 2:\">Step 2:<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#Step_3\" title=\"Step 3: \">Step 3: <\/a><\/li><\/ul><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#2_Ways_to_Limit_Approvals_from_Smart_contracts\" title=\"2 Ways to Limit Approvals from Smart contracts \">2 Ways to Limit Approvals from Smart contracts <\/a><ul class=\"ez-toc-list-level-3\"><li class=\"ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#1_Create_a_New_Wallet\" title=\"1. Create a New Wallet\">1. Create a New Wallet<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#2_Use_DeFi_Portfolio_Tracking_App\" title=\"2. Use DeFi Portfolio Tracking App\">2. Use DeFi Portfolio Tracking App<\/a><\/li><\/ul><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#2_Tips_to_Further_Protect_Your_Tokens\" title=\"2 Tips to Further Protect Your Tokens\">2 Tips to Further Protect Your Tokens<\/a><ul class=\"ez-toc-list-level-3\"><li class=\"ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#1_Use_a_Hardware_Wallet\" title=\"1. Use a Hardware Wallet\">1. Use a Hardware Wallet<\/a><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-3\"><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#2_Use_a_Separate_Browser_Profile\" title=\"2. Use a Separate Browser Profile\">2. Use a Separate Browser Profile<\/a><\/li><\/ul><\/li><li class=\"ez-toc-page-1 ez-toc-heading-level-2\"><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/MrRealFi.com\/limit-token-allowances\/#Conclusion\" title=\"Conclusion  \">Conclusion  <\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Smart_Contract_Hacks_in_2021\"><\/span>Smart Contract Hacks in 2021<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"1_Furucombo\"><\/span>1. Furucombo<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>On 27 February 2021, a hacker used a fake smart contract and tricked <a href=\"https:\/\/furucombo.app\">Furucombo<\/a> into thinking that Aave v2 had a new implementation.<\/p>\n\n\n\n<p>This caused large wallets with the default setting (unlimited tokens approval) to be drained completely. <\/p>\n\n\n\n<p>This attack resulted in close to $15 million lost for Furucombo users. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Cream_Finance\"><\/span>2. Cream Finance<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>2021 is not a good year for the lending protocol, <a href=\"https:\/\/app.cream.finance\">Cream Finance<\/a>. They were attacked multiple times but it all started when Cream Finance made the mistake of having unlimited approvals in their smart contract.  <\/p>\n\n\n\n<p>This tiny error caused the treasury $1.1 million in the first exploit which could easily be prevented with a few clicks on a button. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_You_Should_Change_the_Default_Setting_on_Your_Wallet\"><\/span>Why You Should Change the Default Setting on Your Wallet<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Manually changing the approved amount for each transaction can cause you an additional transaction fee but doing so will prevent your wallets from being drained in case of a smart contract exploit. <\/p>\n\n\n\n<p>In a nutshell, this limits DeFi protocols&#8217; spending permission so, in cases of attack, your wallet will not be targeted at best&#8230; and if an attack does happen, your wallet will not be wiped out entirely.<\/p>\n\n\n\n<p>For more reasons, check out these articles: <\/p>\n\n\n\n<ul><li><a href=\"https:\/\/brogna.medium.com\/token-allowance-dc553f7d38b3\">What about Token Allowances?<\/a> &#8211; Medium <\/li><li><a href=\"https:\/\/kalis.me\/unlimited-erc20-allowances\/\">Unlimited ERC20 allowances considered harmful<\/a> &#8211; Kalis <\/li><\/ul>\n\n\n\n<p>To manually change the default setting, follow the step-by-step guide below. <\/p>\n\n\n\n<div class=\"su-box su-box-style-default\" id=\"\" style=\"border-color:#000000;border-radius:3px\"><div class=\"su-box-title\" style=\"background-color:#333333;color:#FFFFFF;border-top-left-radius:1px;border-top-right-radius:1px\">Note<\/div><div class=\"su-box-content su-u-clearfix su-u-trim\" style=\"border-bottom-left-radius:1px;border-bottom-right-radius:1px\">The guide below is shown in the Ethereum network since at the time of writing this post Cardano&#8217;s smart contract is not yet available. Nevertheless, I believe that Cardano&#8217;s smart contract will have somewhat a similar setting as seen below. The same is true for Binance Smart Chain (BSC). <\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step-by-step_Guide_on_How_to_Limit_Smart_Contracts_Approval\"><\/span>Step-by-step Guide on How to Limit Smart Contracts Approval<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>One of the most common instances that require smart contract approvals is swapping. In the example below, we will be approving Uniswap token on our Metamask wallet.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_1\"><\/span>Step 1:<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Step-1-Approval-Token-on-Metamask-1-670x1024.png\" alt=\"Step 1: Approve Token Allowance\" class=\"wp-image-539\" width=\"503\" height=\"768\" srcset=\"https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Step-1-Approval-Token-on-Metamask-1-670x1024.png 670w, https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Step-1-Approval-Token-on-Metamask-1-196x300.png 196w, https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Step-1-Approval-Token-on-Metamask-1.png 700w\" sizes=\"(max-width: 503px) 100vw, 503px\" \/><\/figure><\/div>\n\n\n\n<ul><li>The first time you trade a token on a DeFi project, you will see something similar to the image above<\/li><li>Click &#8220;Approve&#8221;<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_2\"><\/span>Step 2:<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"800\" height=\"642\" src=\"https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Edit-Token-Allowance-on-Metamask-2-updated.jpg\" alt=\"Click on &quot;View full transaction details&quot;, Click on &quot;Edit&quot; under Permission\" class=\"wp-image-540\" srcset=\"https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Edit-Token-Allowance-on-Metamask-2-updated.jpg 800w, https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Edit-Token-Allowance-on-Metamask-2-updated-300x241.jpg 300w, https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Edit-Token-Allowance-on-Metamask-2-updated-768x616.jpg 768w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/figure><\/div>\n\n\n\n<ul><li>Click on &#8220;View full transaction details&#8221; <\/li><li>Click on &#8220;Edit&#8221; under Permission<\/li><li>Simply choose &#8220;Custom Spend Limit&#8221;<\/li><li>Enter only the amount you want to trade<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Step_3\"><\/span>Step 3: <span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<ul><li>Click &#8220;Confirm&#8221; and pay the transaction fee.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Ways_to_Limit_Approvals_from_Smart_contracts\"><\/span>2 Ways to Limit Approvals from Smart contracts <span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>If you have already given DeFi protocols unlimited spending approvals, there are two options for you. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"1_Create_a_New_Wallet\"><\/span>1. Create a New Wallet<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>The most straightforward option is to move all your funds to a new wallet address.<\/p>\n\n\n\n<p>Doing so will give you a fresh restart without all the risks accociated with your previous wallet.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Use_DeFi_Portfolio_Tracking_App\"><\/span>2. Use DeFi Portfolio Tracking App<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>If moving funds out of your existing wallet is not possible then consider using platform such as <a href=\"https:\/\/zapper.fi\">Zapper<\/a>.<\/p>\n\n\n\n<p>The platform allows you to track all your DeFi portfolio in one place and more importantly, it allows you to set smart contracts approvals with just a few clicks of your button. <\/p>\n\n\n\n<p>Here is how you revoke unlimited approvals on your Zapper dashboard:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"900\" height=\"561\" src=\"https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Zapper-Dashboard-to-Limit-allowance.png\" alt=\"Zapper Dashboard to Limit allowance\" class=\"wp-image-543\" srcset=\"https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Zapper-Dashboard-to-Limit-allowance.png 900w, https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Zapper-Dashboard-to-Limit-allowance-300x187.png 300w, https:\/\/MrRealFi.com\/wp-content\/uploads\/2021\/10\/Zapper-Dashboard-to-Limit-allowance-768x479.png 768w\" sizes=\"(max-width: 900px) 100vw, 900px\" \/><\/figure>\n\n\n\n<ul><li>Click on Settings in the left menu -&gt; <em>Manage&nbsp;<\/em>under Allowances or&nbsp;<a rel=\"noreferrer noopener\" href=\"https:\/\/zapper.fi\/revoke\" target=\"_blank\">go directly here<\/a><\/li><li>Look for any highlighted&nbsp;<em>UNLIMITED&nbsp;<\/em>allowances and then click the green&nbsp;<em>Revoke<\/em>&nbsp;button on the right<\/li><li>Every time you click <em>Revoke<\/em> the spending limit for that smart contract is set to Zero to protect your wallet and tokens<\/li><\/ul>\n\n\n\n<p><em>Credit: <a href=\"https:\/\/learn.zapper.fi\/articles\/how-to-revoke-token-allowances\">How to Revoke Token Allowances on Zapper<\/a><\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Tips_to_Further_Protect_Your_Tokens\"><\/span>2 Tips to Further Protect Your Tokens<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"1_Use_a_Hardware_Wallet\"><\/span>1. Use a Hardware Wallet<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Hardware wallets such as <a href=\"https:\/\/www.ledger.com\">Ledger<\/a> and <a href=\"https:\/\/trezor.io\">Trezor<\/a> are made to secure your cryptocurrencies by having private keys that are separated from internet-connected devices. <\/p>\n\n\n\n<p>The private keys are maintained in a secured offline environment so even if your computer is infected with malware, your hardware wallets will not be compromised. <\/p>\n\n\n\n<p>A hardware wallet is a physical device that can be stolen but it is not accessible to the thief if he\/she does not have your password. <\/p>\n\n\n\n<p>In the unfortunate case that your hardware wallet is stolen or damaged, you will still be able to recover your tokens if you had created a secret backup code.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Use_a_Separate_Browser_Profile\"><\/span>2. Use a Separate Browser Profile<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>If you accidentally installed a malicious extension on your browser, your browser wallets such as <a href=\"https:\/\/metamask.io\">Metamask<\/a>, <a href=\"https:\/\/yoroi-wallet.com\/#\/\">Yoroi<\/a>, and <a href=\"https:\/\/namiwallet.io\">Nami<\/a> may be compromised. <\/p>\n\n\n\n<p>To further improve your security, be sure to create a separate profile on your Google chrome.<\/p>\n\n\n\n<p>Alternatively, you can also use an entirely different browser, such as <a href=\"https:\/\/brave.com\">Brave<\/a>, solely for blockchain and crypto trading purposes.<\/p>\n\n\n\n<p>Doing so will reduce your risk of a malicious browser extension hack. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span>Conclusion  <span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>The DeFi space is still in its infant stage so be sure to do your research before using any DeFi protocols&#8230; especially those that are not battle-tested. <\/p>\n\n\n\n<p>Once your funds are lost in the DeFi ecosystem, it will be close to impossible to recover them. <\/p>\n\n\n\n<p>Stay secure. Stay safe. Always. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Since smart contract hacks are incredibly common these days, it is important that you set up your own line of defense to minimize risk. The first thing you can do is limit smart contract approval. If you have participated in a DeFi protocol then you have already given smart contracts access to spend your wallet&#8217;s [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":""},"categories":[7],"tags":[],"_links":{"self":[{"href":"https:\/\/MrRealFi.com\/wp-json\/wp\/v2\/posts\/494"}],"collection":[{"href":"https:\/\/MrRealFi.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/MrRealFi.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/MrRealFi.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/MrRealFi.com\/wp-json\/wp\/v2\/comments?post=494"}],"version-history":[{"count":3,"href":"https:\/\/MrRealFi.com\/wp-json\/wp\/v2\/posts\/494\/revisions"}],"predecessor-version":[{"id":554,"href":"https:\/\/MrRealFi.com\/wp-json\/wp\/v2\/posts\/494\/revisions\/554"}],"wp:attachment":[{"href":"https:\/\/MrRealFi.com\/wp-json\/wp\/v2\/media?parent=494"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/MrRealFi.com\/wp-json\/wp\/v2\/categories?post=494"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/MrRealFi.com\/wp-json\/wp\/v2\/tags?post=494"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}