Wallet Drainer Tracker: Phishing Losses by Month
What wallet drainers take each month, on which chains and through which signatures: approvals, permits, NFT listings and delegations.
Multi-chainEthereumTable · StrataPlanned
Token Approval Checker: Open Allowances by Wallet
Which contracts can still spend tokens from this wallet, and for how much?
Every spender that can still move a wallet's tokens or NFTs, with the allowance, when it was granted and the transaction that set it.
- Multi-chain
ShareEmail it
Blueprint
What the table will hold.
The table as it will open in Strata. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
One row One row per wallet, chain, token and spender with an open approval at the latest blockSorted by Value at risk, highest first
| Token | Chain | Approval kind | Spender | Spender label | Allowancetokens | Value at riskUSD | Granted | Expires | Receipt |
|---|---|---|---|---|---|---|---|---|---|
- Token token Token
- The approved token's name and symbol, linked to its contract.
- Chain chain Chain
- The chain the token contract and the approval live on.
- Approval kind approval_kind Text
- Exact amount, unlimited, a whole NFT collection (ApprovalForAll), a single NFT or a Permit2 grant.
- Spender spender Address
- The contract or address allowed to move the tokens.
- Spender label spender_label Text
- What the spender is (a DEX router, a marketplace, a bridge or a known drainer) with the label's source, or unknown.
- Allowance allowance Exact amount
- The amount the spender may still move, read at the latest block; shown as unlimited at the largest value.
- Value at risk value_at_risk Exact amount
- The smaller of the allowance and the wallet's balance, valued at the latest oracle or DEX pool price.
- Granted granted_at Date
- The date of the transaction that set the current allowance.
- Expires expires_at Date
- When a Permit2 allowance expires; ERC-20 and NFT approvals do not expire on their own.
- Receipt receipt Link
- The granting transaction and the latest-block read that shows the approval is still open.
Filter by Chain, Approval kind, Spender label.
About
What it answers, and for whom.
Every time a wallet lets an app move its tokens, it leaves an approval on-chain, and that approval stays until it is used up or revoked. This table lists every open approval for a wallet across chains: the token, the spender, the allowance and when it was granted, confirmed against the token contracts at the latest block.
Unlimited approvals and approvals over a whole NFT collection are the ones drainers and exploited contracts use, so they are marked, along with the spender's label where one is known. Sort by value at risk or by date and filter by chain or approval kind. Open any row for the transaction that granted it and the read that shows it is still open.
The table only reads. Revoking happens from the wallet itself, by sending a transaction that sets the allowance to zero, and the row disappears once the next read confirms it.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- Candidate approvals come from ERC-20 Approval logs, ERC-721 and ERC-1155 ApprovalForAll logs and Permit2 Approval and Permit logs in which the wallet is the owner.
- Each candidate is confirmed at the latest block with allowance(owner, spender), isApprovedForAll(owner, operator) or the Permit2 allowance(owner, token, spender), so used and revoked approvals drop out.
- An ERC-20 allowance counts as unlimited when it equals the largest uint256 value or exceeds the token's total supply.
- The value at risk for an ERC-20 row is the smaller of the allowance and the wallet's balance, valued at the latest oracle or DEX pool price.
- Spender labels come from the address registry with their sources; an unlabelled spender is shown as unknown, never as safe.
The data it needs
Read from chain state and history
- token_approvalsTo buildToken approvalsActive ERC-20 and NFT approvals per wallet and spender, with the spender's label and when the approval was set.
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- token_holders_snapshotTo buildToken holders and concentrationHolder counts, top holders and concentration shares of registry tokens at a pinned block, with contract and exchange labels.
- native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- ERC-20 Approval(owner, spender, value) logs where the wallet is the owner
- allowance(owner, spender) via eth_call at the latest block
- ERC-721 and ERC-1155 ApprovalForAll logs and isApprovedForAll(owner, operator) at the latest block
- Permit2 Approval, Permit and Lockdown logs and allowance(owner, token, spender) reads
- balanceOf(owner) of each approved token at the same block, for the value at risk
Questions
Questions people ask.
What is a token approval?
An approval is a permission a wallet gives a contract to move its tokens, set with approve() for ERC-20 tokens or setApprovalForAll() for NFT collections. Apps need it to swap or list tokens on the wallet's behalf, and it stays in place after the app has been used.
Why are unlimited token approvals risky?
An unlimited approval lets the spender move the wallet's whole balance of that token at any time, now or later. If the spender contract is exploited, or was malicious from the start, every token the approval covers can be taken without another signature.
How do I revoke a token approval?
Revoking is a transaction from the wallet: approve(spender, 0) for an ERC-20 token, setApprovalForAll(operator, false) for an NFT collection or a zero-amount approval or lockdown on Permit2. It pays the chain's normal fee, and this table shows the new state once it is mined.
What are Permit2 allowances?
Permit2 is a shared contract that many apps use to move tokens. A wallet approves Permit2 once per token, then grants each app its own allowance inside Permit2, with an amount and an expiry. Both layers are listed here, each with its own row.
Does revoking an approval on one chain revoke it everywhere?
No. An approval lives in one token contract on one chain, so the same token on another chain, or a bridged copy of it, has its own approvals. The table lists each chain's approvals separately for that reason.
- Allowance
- The amount of a token a spender may still move from a wallet, as returned by the token's allowance(owner, spender) function.
- ApprovalForAll
- An NFT approval that lets an operator move every token a wallet holds in one ERC-721 or ERC-1155 collection.
- Unlimited approval
- An allowance set to the largest value the token allows, so it never runs out however much the spender moves.
Related
More apps like this.
Token Safety Check: Mint, Blacklist and Owner Powers
The powers a token contract still keeps, from minting and blacklisting to pausing, fee changes and upgrades, read from the contract.
Multi-chainCrypto Address Checker: Flagged, Sanctioned or Hacked
Check an address before you send or accept funds: direct flags and one-hop links to sanctioned, frozen, hacked or phishing addresses.
Multi-chainEthereumTron+1Wallet Balance Checker: Every EVM Chain in One View
Look up any EVM address and see what it holds on every covered chain, token by token, with first and last activity and no wallet to connect.
Multi-chainEthereumBase+4Safe Multisig Checker: Owners, Threshold and Modules
Inspect a Safe before trusting it: its signers, how many must sign, the modules and guards that can act on it and its recent changes.
Multi-chainEthereumBase+3Bitcoin Quantum Risk: BTC in Exposed Public Key Addresses
Bitcoin held in outputs whose public keys are already visible on-chain, split by script type and tracked day by day.
BitcoinBuild Token Approval Checker: Open Allowances by Wallet on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.