Checking and revoking approvals

Graduate · enrolled learners

This lesson opens with BadgerDAO, 2 December 2021.

What happened

BadgerDAO is a protocol for earning yield on Bitcoin. On 2 December 2021 attackers who had compromised the project's front-end, through a stolen cloud API key that let them inject a script into the website, added a hidden step to users' ordinary interactions: an extra ERC-20 approval that granted the attacker's address permission to spend the user's tokens. Nothing on the BadgerDAO contracts was broken. Users, using the real site, approved the malicious allowance themselves, and over the following days the attacker used those standing approvals to withdraw about 120 million dollars from the wallets that had granted them. The permissions kept working long after the single click that created each one, because that is what an approval is: a grant that persists until it is spent or revoked.

The decision point

The BadgerDAO victims did not sign away their funds in the drain transaction; they signed a permission, days earlier, that let someone else move the funds later. This is the property of approvals that surprises people: an approval is not a one-time transfer, it is a standing key handed to another address, and it keeps working until it is revoked. A user who never reviews their approvals accumulates a set of standing keys, granted to protocols they may no longer use and to at least one address they never meant to trust, each of which can drain the token it covers at any time. Checking and revoking approvals is the hygiene that closes those keys, and it is a tool a non-developer can run in a few minutes against their own address.

Recorded loss

$120,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.