Intermediate
Approval Patterns & Token Permissions — Hands-on lab
Understand token flows.
Developer Intermediate
4/6 — Approval Patterns & Token Permissions — Hands-on lab
Prove it in tests Demonstrate a malicious spender draining an allowance, then show how your limits, permits, and revokes stop it. Build UI panels that make risk visible and fixes easy.
UX drills Show spender names/addresses, warn on unlimited allowances, and provide one-click revoke/reset. Add tooltips that explain risks in simple language.
Operational drill Simulate a compromised spender and walk through revoking and reissuing safe approvals. Capture this as a short runbook.
function permit(
address owner,
address spender,
uint256 value,
uint256 deadline,
uint8 v, bytes32 r, bytes32 s
) external {
require(block.timestamp <= deadline, "expired");
bytes32 digest = keccak256(abi.encodePacked(
"\x19\x01",
DOMAIN_SEPARATOR,
keccak256(abi.encode(
PERMIT_TYPEHASH,
owner,
spender,
value,
nonces[owner]++,
deadline
))
));
address signer = ECDSA.recover(digest, v, r, s);
require(signer == owner, "bad sig");
_approve(owner, spender, value);
}Steps
- Implement approve/transferFrom flows and:Demonstrate a front-run scenario in tests; add guards where applicable.
- Add EIP-2612 permit to:Your token or integrate Permit2 for third-party tokens; test domain, deadline, nonce checks.
- Build a UI panel:Listing current allowances; add “revoke” and “set limit” actions; default new approvals to minimal amounts.
- Add per-spender caps in:A pull-based contract; reject outsized approvals and emit clear events.
- Write tests for reentrancy:Or malicious spender misuse; ensure approvals are consumed only in expected functions.
- Document guidance for users:When to revoke, why to limit, and how to verify spender addresses.