token approval
A token approval is a permission slip you sign that lets some other address move your tokens on your behalf. Because an ERC-20 balance is just an entry in the token's contract, a decentralized exchange cannot reach in and take your tokens directly — you must first call approve(spender, amount) on the token, recording that the spender is allowed to pull up to that amount later via transferFrom. Almost every DeFi action (swapping, depositing, lending) begins with one of these approvals.
The convenience trap is the unlimited approval. To save users from re-approving before every trade, apps routinely request an amount of 2^256 minus 1 (written type(uint256).max), an effectively infinite allowance. That is fine while the spender contract is honest and bug-free, but if that contract is later exploited or was malicious to begin with, it can drain the entire approved balance at any time, long after you stopped using the app. Approvals persist on-chain until you change them.
Good hygiene is to approve only the amount you need, to revoke approvals you no longer use (set the allowance back to zero, e.g. via tools like revoke.cash), and to read wallet prompts carefully. The same risk exists for NFTs through setApprovalForAll, which grants an operator the right to move every NFT in a collection you own — a single careless approval to a phishing contract can lose a whole wallet of art.
You swap once on a DEX and the wallet asks to approve 'unlimited'. Months later that router is exploited; the attacker calls transferFrom on every wallet that still holds an open infinite allowance and drains them — including yours, even though you never returned to the site.
Approving is not spending — your approval transaction does not move any tokens. The danger is that it quietly authorizes someone else to move them later, on their schedule, not yours.