Token Approval Exploits
Token approval exploits occur when a malicious actor gains control over a user's wallet permissions, allowing them to transfer the user's tokens without consent. Many DeFi platforms require users to "approve" the protocol to spend their tokens.
If the protocol's contract is insecure or has a hidden "backdoor," the attacker can trigger the transfer function to drain the user's funds. This is a common attack vector in phishing campaigns and malicious dApps.
Because these approvals are often set to an "infinite" limit, the attacker can drain the entire balance of the approved token at any time. Users must be extremely cautious about which protocols they grant approval to and should periodically revoke permissions for unused dApps to minimize their attack surface.