Security Center
Approval Security
A practical imtoken guide to approval security, including core concepts, verification steps and risk-aware usage.
imtoken staff will never ask for your seed phrase, private key or verification code.
Core concepts
After a Approval Security task is completed, review permission scope and revoking approvals to make sure the outcome matches the intent. Long-lived approvals and persistent connections should be revisited periodically. Good wallet hygiene is a repeated process of checking critical details and retaining traceable on-chain information, not a one-time setting.
For allowance size, first define its role in the current task, then check whether malicious contracts and approval targets are consistent. When permission scope is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For revoking approvals, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: allowance size
- Cross-check: malicious contracts and approval targets
- Review carefully: permission scope
- Verify afterward: revoking approvals
Checks before you act
To understand Approval Security, treat malicious contracts and approval targets as parts of the same on-chain workflow. The interface is only the entry point; the selected network, current chain state and permission scope determine what actually happens. Confirm the destination, source and network before continuing so the meaning of the request stays clear.
For malicious contracts, first define its role in the current task, then check whether approval targets and permission scope are consistent. When revoking approvals is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For allowance size, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: malicious contracts
- Cross-check: approval targets and permission scope
- Review carefully: revoking approvals
- Verify afterward: allowance size
How to evaluate a live request
approval targets rarely appears in isolation. It often intersects with permission scope and revoking approvals. A useful pattern is to separate each action into four checks: identify the object, verify the network, review permissions, and confirm the result. If one of those checks cannot be completed, stop and verify rather than relying on an unfamiliar site or remote instructions.
For approval targets, first define its role in the current task, then check whether permission scope and revoking approvals are consistent. When allowance size is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For malicious contracts, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: approval targets
- Cross-check: permission scope and revoking approvals
- Review carefully: allowance size
- Verify afterward: malicious contracts
Risks and boundaries
When using imtoken for Approval Security, prioritize information that can be independently verified, such as addresses, network names, contract addresses, transaction hashes and block-explorer records. Visual design, urgency messages or claims from an unknown support account are not substitutes for verifiable on-chain details.
For permission scope, first define its role in the current task, then check whether revoking approvals and allowance size are consistent. When malicious contracts is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For approval targets, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: permission scope
- Cross-check: revoking approvals and allowance size
- Review carefully: malicious contracts
- Verify afterward: approval targets
How to verify the outcome
From a risk perspective, malicious contracts and approval targets deserve an independent review. Once a transaction is confirmed on-chain, a wallet normally cannot reverse it unilaterally. DApps and smart contracts can also introduce permission and contract risks, so every signature, approval and transfer should be understood before it is accepted.
For revoking approvals, first define its role in the current task, then check whether allowance size and malicious contracts are consistent. When approval targets is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For permission scope, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: revoking approvals
- Cross-check: allowance size and malicious contracts
- Review carefully: approval targets
- Verify afterward: permission scope
Security checklist
- Never share your seed phrase, private key or verification code.
- Verify the address, network and amount before sending.
- Review each DApp signature and token approval independently.
- Use transaction hashes and block explorers to verify on-chain status.
- Revoke approvals and disconnect sessions that are no longer needed.