Standards

Allowance

Allowance is the ERC20 amount an owner permits a spender to transfer from the owner's balance through transferFrom.

An allowance is permission for another address to spend your ERC20 tokens up to a limit.

Allowance Explained in Detail

Allowance is delegated spending power. The owner calls approve(spender, amount), then the spender can call transferFrom(owner, recipient, amount) up to the approved amount.

Routers, vaults, bridges, and marketplaces often depend on allowances.

Smart contract example

token.approve(router, type(uint256).max);
router.swap(...);

An infinite approval is convenient, but it creates long-lived spending risk.

Allowance in Auditing

Allowance bugs can let spenders drain tokens or fail to spend when expected. Auditors review allowance changes, stale approvals, permit flows, and non-standard token behavior.

Allowance also interacts with the ERC20 approval race condition.

Red flags in code

  • Infinite approvals to untrusted or upgradeable contracts.

  • Allowance is changed from one nonzero value to another without safeguards.

  • transferFrom return values are ignored.

  • Permit and approval flows disagree.

  • Non-standard ERC20 tokens are assumed to behave normally.

How to test or review it

  • Test approve, increase, decrease, and transferFrom paths.

  • Front-run allowance changes in tests where relevant.

  • Test stale approvals after withdraw, cancel, or close flows.

  • Use SafeERC20 for integration-heavy token calls.

  • Include non-standard, fee-on-transfer, and rebasing token cases when supported.

ERC-20 Approval Race Condition

The ERC-20 approval race condition is a token allowance issue where a spender can use an old allowance before a new allowance change takes effect.

ERC-20 Permit (EIP-2612)

ERC20 permit lets a token owner approve an ERC20 allowance with a signature instead of sending an on-chain approve transaction.

Permit2

Permit2 is Uniswap's shared approval and signature transfer system that lets users authorize token spends through structured signatures or managed allowances.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like Allowance into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources