MEVDAO

Wallet Drainer Approvals: Permit, SetApprovalForAll & 7702

By Merunas Grincalaitis · · 11 min read · 0 views

By Merunas Grincalaitis (X · GitHub · DEV · Hashnode · Telegram), Founder & Lead MEV Engineer at MEV DAO — Ethereum smart contract, Flashbots & MEV builder since 2017. Last updated: October 2026.

TL;DR: Modern Ethereum phishing attacks rarely ask for your seed phrase. Instead, they trick you into signing off-chain permit phishing messages (EIP-2612 Permit or Uniswap Permit2), on-chain wallet drainer approvals (approve and setApprovalForAll), or an eip 7702 account delegation authorization that hands complete execution control of your EOA to a malicious contract. Knowing which signature type you signed determines whether you can simply revoke the allowance or whether you need an emergency Flashbots token rescue.

Part of the Compromised Wallet & Sweeper Bot Rescue Topic Cluster: Start with our Pillar Guide, How to Rescue Tokens From a Compromised Wallet With a Sweeper Bot (Flashbots Guide), for the complete architectural blueprint. This forensic guide dissects How Wallet Drainer Phishing Kits Construct EIP-2612 Permit, Permit2, setApprovalForAll, and EIP-7702 Payloads (for the step-by-step cleanup tutorial, see How to Revoke Token Approvals and Permit2 Signatures).

When someone messages me saying their MetaMask or Rabby wallet was just emptied without them ever typing their 12-word recovery phrase, the culprit is almost always one of four signature primitives: standard ERC-20 approve, NFT setApprovalForAll, gasless permit phishing (EIP-2612 / Permit2), or a malicious eip 7702 delegation.

Commercial drainer kits—often discussed or leaked in security research around wallet drainer github repositories like Angel Drainer, Pink Drainer, and Inferno Drainer—automatically scan a victim's wallet balance the moment they connect to a fake airdrop or mint site. The script ranks your assets by USD value and pops up the exact signature prompt most likely to bypass wallet warnings. Below is how each of those wallet drainer approvals works under the hood, how to diagnose what you signed on Etherscan, and how to stop the bleeding if assets are still left in your address.

Architecture diagram of wallet drainer approvals workflow on Ethereum showing Compromised Key, Sponsor + Claim Tx, eth_callBundle Sim, and Flashbots Block Rescue
Figure 1: End-to-end Ethereum execution pipeline for wallet drainer approvals (Compromised Key → Sponsor + Claim Tx → eth_callBundle Sim → Flashbots Block Rescue).

How modern wallet drainer approvals work on Ethereum

Four years ago, phishing sites had to convince you to send ETH directly or pay gas for an on-chain approve() transaction. Today, drainers rely heavily on off-chain EIP-712 typed-data signatures (eth_signTypedData_v4) and EIP-7702 authorization tuples because signing a message costs the victim zero gas and looks like a harmless login prompt to an untrained eye.

Attack Vector On-Chain or Off-Chain Sign? What It Can Steal Persists After First Drain? Exact Remediation Step
ERC-20 approve(spender, max) On-chain transaction (costs gas) One specific ERC-20 token up to the approved allowance Yes — attacker can drain future deposits of that token Revoke allowance (approve(spender, 0)) via Revoke.cash or Etherscan
EIP-2612 Permit Phishing Off-chain EIP-712 signature (gasless) One specific ERC-2612 token (USDC, UNI, DAI, etc.) Yes, once attacker broadcasts permit() on-chain Call permit or approve(spender, 0) to increment your token nonces(owner)
Uniswap Permit2 Signature Off-chain EIP-712 batch signature (gasless) Multiple ERC-20 tokens at once (any token previously approved to Permit2) Yes, until expiration timestamp or nonce invalidation Call invalidateUnorderedNonces or lockdown on the canonical Permit2 contract
NFT setApprovalForAll(operator, true) On-chain transaction (costs gas) Every NFT (ERC-721 / ERC-1155) in that collection Yes — steals any future NFTs from that collection too Call setApprovalForAll(operator, false) immediately
Malicious eip 7702 Delegation Off-chain Type-0x04 Auth signature (or bundled tx) Everything in the wallet (ETH, all ERC-20s, NFTs, staked claims) Yes — acts like a live smart-contract sweeper inside your EOA Broadcast a Type-0x04 revocation delegating back to 0x000...000 via private bundle

If your wallet is actively losing funds right now and you are searching wallet stolen what to do or stolen wallet what to do, stop reading and follow our emergency checklist in Wallet Drained? What to Do in the First Hour (Ethereum Checklist) or contact our Sweeper Bot Rescue Service.

1. Permit phishing: How gasless EIP-2612 and Permit2 signatures drain ERC-20s

Why is permit phishing the #1 weapon of Ethereum drainers in 2026? Because millions of DeFi users have already approved Uniswap's canonical Permit2 contract (0x000000000022D473030F116dDEE9F6B43aC78BA3) to spend their USDT, USDC, WBTC, PEPE, and WETH.

Here is how a Permit2 drainer exploits that existing setup in two seconds:

  1. Years or months ago, you swapped USDC and PEPE on Uniswap. During that swap, you granted an infinite ERC-20 approve() to the official Uniswap Permit2 contract so future swaps would only require a free off-chain signature.
  2. Today, you click a fake "Claim Arbitrum / EigenLayer / Uniswap V4 Reward" link on X or Discord.
  3. The phishing site reads your wallet, sees that Permit2 already has allowance for five of your tokens, and constructs an off-chain PermitBatch EIP-712 message naming the attacker's drainer contract as the spender.
  4. You click Sign in your wallet (no gas fee required).
  5. The attacker's backend immediately takes your signature (v, r, s) and submits an on-chain transaction calling Permit2.permitTransferFrom(), sweeping all five ERC-20 balances out of your wallet in a single block while paying the gas from their own relayer wallet!

Even if a token does not use Permit2, major tokens like USDC, DAI, and UNI implement native EIP-2612 permit(owner, spender, value, deadline, v, r, s). If you sign an EIP-2612 message and realize your mistake before the attacker submits it on-chain, you can invalidate the stolen signature by immediately calling approve(attacker, 0) on the token (or transferring 0 tokens in protocols that increment the permit nonce), or by revoking the allowance the instant it lands on-chain. We walk through the exact contract calls in How to Revoke Token Approvals and Permit2 Signatures.

2. Standard ERC-20 `approve` and NFT `setApprovalForAll` traps

When a token does not support gasless permits—and you have not yet approved Permit2 for it—drainer scripts fall back to on-chain wallet drainer approvals:

  • Disguised increaseAllowance or approve calls: Instead of calling approve() directly, some drainers route through a custom multicall or fake Claim() function on a spoofed contract, or prompt an approve(drainerAddress, 2^256 - 1) hoping you click through the wallet confirmation without expanding the spender address.
  • NFT setApprovalForAll(operator, true): One single setApprovalForAll transaction gives the operator contract permission to transfer every single NFT you hold in that collection (Bored Ape, Pudgy Penguins, ENS names, or Uniswap V3 LP position NFTs).

Remember: a malicious token approval only compromises the specific token or NFT collection you approved. It does not expose your private key, and it cannot sweep native ETH—unless what you actually signed was an EIP-7702 delegation.

3. What is EIP 7702, and how do EIP-7702 drainer delegations work?

Since Ethereum's Pectra upgrade activated eip 7702 on mainnet (as well as BNB Chain, Base, Optimism, and Arbitrum—check eip-7702 status on your target chain), externally owned accounts (EOAs) can temporarily or persistently attach a smart contract implementation directly to their own address using a 0x04 authorization tuple.

If you are asking what is eip 7702 in the context of wallet security: it is the feature that lets a standard wallet act like a smart account (enabling batch transactions and sponsored gas), but in the hands of a phisher, an EIP-7702 authorization is equivalent to handing over your private key.

When a phishing site tricks a user into signing an EIP-7702 authorization pointing to a malicious contract (0xef0100 || maliciousContractAddress):

  • The attacker's code is now mounted directly onto your wallet address.
  • It can sweep native ETH, transfer every ERC-20 and NFT without needing individual approve() calls, and automatically forward any future ETH you send to the wallet to pay for revocation gas!

Unlike a standard ERC-20 approval, you cannot fix a malicious EIP-7702 delegation on Revoke.cash if the delegated contract blocks incoming gas or sweeps native ETH. You must overwrite the delegation back to 0x0000000000000000000000000000000000000000 using a sponsored Type-0x04 transaction or a private Flashbots bundle. See our full technical guide on How to Check and Remove a Malicious EIP-7702 Delegation, our comparison of EIP 7702 Rescue vs Flashbots Bundles: Saving Tokens, and our open-source tool eip-7702-delegation-checker-revoker on GitHub.

Step-by-step: What to do right now if you signed a phishing approval

  1. Determine whether your key/EOA is compromised or only a token allowance:
    • Paste your address into Etherscan. Look at the Address header: does it show a Delegated to ... badge (0xef0100...)? And are native ETH deposits being swept out automatically within 1–2 blocks?
    • If only specific ERC-20s or NFTs were moved via TransferFrom while native ETH sits untouched in your wallet, you signed wallet drainer approvals or permit phishing—your private key itself is still safe.
  2. Revoke active allowances and Permit2 permissions immediately:
    • Open Revoke.cash or Etherscan's Token Approval Checker, sort by newest approvals, and revoke any unknown spender contracts.
    • If you signed a Permit2 batch message, call lockdown() on the Uniswap Permit2 contract for the affected tokens so the attacker cannot replay an unsubmitted off-chain signature later.
  3. If you have a live sweeper or malicious EIP-7702 delegation, do NOT send ETH to the wallet:
    • Any ETH you send to pay gas for revoking or transferring remaining staked tokens, airdrops, or NFTs will be stolen by the sweeper in the next block.
    • Instead, use a private eth_sendBundle rescue where a clean sponsor wallet pays the gas in Transaction #1, your compromised wallet revokes or transfers in Transaction #2, and a builder bribe secures atomic execution. Read How to Rescue Tokens from a Compromised Wallet with a Sweeper Bot.

Frequently asked questions

Can permit phishing drain my wallet without me paying gas?

Yes. Both EIP-2612 Permit and Uniswap Permit2 use off-chain EIP-712 typed-data signatures (eth_signTypedData_v4). Signing the message in MetaMask or Rabby is completely free and off-chain; the attacker then submits your signed message to the blockchain from their own funded wallet and pays the gas fee to drain your tokens.

How do I cancel a Permit or Permit2 signature before the hacker uses it?

Because off-chain signatures do not appear on the blockchain until the attacker broadcasts them, they will not show up in standard approval checkers until after they execute. To invalidate a stolen EIP-2612 signature before it is used, immediately submit an on-chain permit() to yourself or move the tokens to a fresh wallet so the nonce increments; for Permit2, call the lockdown() or invalidateUnorderedNonces() function on the Permit2 contract (0x000000000022D473030F116dDEE9F6B43aC78BA3).

Does revoking wallet drainer approvals make my compromised seed phrase safe?

No. Revoking token approvals (approve(spender, 0)) only stops a third-party smart contract from calling transferFrom on your tokens. If a scammer stole your actual 12-word seed phrase or private key—or if an eip 7702 delegation is attached to your address—revoking ERC-20 allowances will not stop them from draining the wallet.

What is the difference between setApprovalForAll and a regular token approval?

A standard ERC-20 approve(spender, amount) grants permission to spend a specific quantity of one fungible token. An ERC-721 or ERC-1155 setApprovalForAll(operator, true) grants the operator blanket permission to transfer every single NFT you currently hold—or ever receive in the future—from that NFT smart contract.

What should I do if I still have staked tokens or unclaimed airdrops in a drained wallet?

Never send ETH into a wallet monitored by a sweeper bot or infected with an EIP-7702 drainer. Use a private Flashbots bundle (or EIP-7702 atomic rescue) that bundles gas sponsorship, unstaking/claiming, and token transfer into one indivisible block Transaction sequence so the sweeper never sees unspent ETH.

Have locked tokens, vesting claims, or NFTs trapped behind a drainer or EIP-7702 sweeper? Contact our Sweeper Bot Rescue Service (no upfront fee—we only take a percentage of rescued assets) or message me urgently on Telegram at @merunas.

← More on Scams & Wallet Security All articles