Curriculum·G204 Tools a Non-Developer Can Run·about 30 min
Checking and revoking approvals
By the end of this lesson you can
- →Explain what a token approval is: a standing permission that outlives the transaction that created it
- →Explain how a compromised BadgerDAO front-end drained about 120 million dollars through approvals users granted themselves
- →Compute the difference between an exact-amount approval and an unlimited one, and what each leaves standing
- →Check the active approvals on an address and revoke the stale and excessive ones
Graduate · enrolled learners
This lesson opens with BadgerDAO, 2 December 2021.
- What happened
- BadgerDAO is a protocol for earning yield on Bitcoin. On 2 December 2021 attackers who had compromised the project's front-end, through a stolen cloud API key that let them inject a script into the website, added a hidden step to users' ordinary interactions: an extra ERC-20 approval that granted the attacker's address permission to spend the user's tokens. Nothing on the BadgerDAO contracts was broken. Users, using the real site, approved the malicious allowance themselves over roughly two weeks, more than 500 addresses in all, and starting just after midnight UTC on 2 December the attacker used those standing approvals to withdraw about 120 million dollars from the wallets that had granted them, for about two hours and twenty minutes until the team paused the contracts. The permissions kept working long after the single click that created each one, because that is what an approval is: a grant that persists until it is spent or revoked.
- The decision point
- The BadgerDAO victims did not sign away their funds in the drain transaction; they signed a permission, hours or days earlier, that let someone else move the funds later. This is the property of approvals that surprises people: an approval is not a one-time transfer, it is a standing key handed to another address, and it keeps working until it is revoked. A user who never reviews their approvals accumulates a set of standing keys, granted to protocols they may no longer use and to at least one address they never meant to trust, each of which can drain the token it covers at any time. Checking and revoking approvals is the hygiene that closes those keys, and it is a tool a non-developer can run in a few minutes against their own address.
- Recorded loss
- $120,000,000
What you will be able to answer
- →How were BadgerDAO users drained?
- →What is an ERC-20 approval?
- →Exact-amount versus unlimited approval?
- →What hygiene closes standing approval risk?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://rekt.news/badger-rekt
- https://www.halborn.com/blog/post/explained-the-badgerdao-hack-december-2021
- https://revoke.cash/learn/approvals/what-are-token-approvals
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
Rekt and Halborn put the BadgerDAO loss at about 120 million dollars at the prices of the day. Halborn says the compromise likely started with a stolen API key for the project's Cloudflare account; Rekt, writing on the day, reported it as a rumor. The timing is Rekt's: the first malicious approvals about two weeks before, the drain from 00:00:23 UTC on 2 December until the pause about two hours and twenty minutes later.
Approval-checking tools and the exact steps to revoke differ by wallet and by chain; the lesson teaches the standing-permission concept and the revocation habit, not one tool's interface.