Understand ERC-20 spender permissions and wallet control before granting access to Ethereum tokens.
Key control comes before convenience
An Ethereum mainnet wallet may be externally connected, created by a bot or managed with a shared signing service. Ask who can authorize a transaction, how keys are stored and what recovery requires. The label “non-custodial” is not a substitute for understanding the implementation. Our tables leave custody unknown where the current chain review cannot substantiate it.
Permissions have a lifecycle
ERC-20 allowances authorize a spender, may remain after a swap and can expose future token balances. Verify the spender against official protocol information, inspect the allowance amount and reconsider unused permissions. Disconnecting a wallet from a website removes a connection, not the contract permission recorded on Ethereum.
| Action | What changes |
|---|---|
| Connect wallet | The site can request account information and subsequent authorization. |
| Sign a message or permit | May authorize an action or permission; read the exact meaning. |
| ERC-20 approve | Creates or changes a token spending allowance. |
| Swap | Executes the contract path authorized by the transaction. |
| Revoke allowance | Reduces spending permission; can itself require ETH gas. |
Verify the contract, not the token name
A fraudulent ERC-20 can copy a familiar symbol. Obtain its address from the project’s official documentation and inspect explorer details. Verified code is useful evidence of correspondence between published code and deployment; it is not a finding that the contract is harmless. Upgrade powers and transfer restrictions deserve separate attention.
Separate research from authorization
You can inspect an Ethereum mainnet explorer, token page or quote without granting a token allowance. Bookmark the official trading interface and reject unsolicited support links. Keep recovery material offline. A separate limited trading wallet can constrain exposure, but cannot rescue a trade already authorized against a malicious contract.
MEV protection is a narrower promise
Private transactions target aspects of Ethereum transaction exposure and ordering. They do not authenticate a website, validate an ERC-20 spender or guarantee withdrawal access. If a bot claims MEV protection, identify the covered order modes and failure behavior rather than treating the label as a general security assessment.
Before using a new bot
- Confirm official URL and Ethereum support.
- Understand wallet generation, export, recovery and withdrawal.
- Inspect ERC-20 spender permissions independently of bot marketing.
- Keep ETH for gas and avoid exposing the entire portfolio.
- Review permissions after testing; do not send secrets in a support enquiry.
Official references
- Ethereum account model
- ERC-20 token standard
- Ethereum security guidance
- Revoke.cash allowance guide
- Flashbots Protect documentation
Frequently asked questions
Does disconnecting revoke an approval?
No. Review the on-chain allowance separately.
Does importing a key prove sole custody?
No. Determine who can access the key and authorize transactions after import.