imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.

imtoken

Token Approvals

Understand approval targets, allowances, scope, contract addresses and revocation practices.

On this page

Understand Approval target first

In Token Approvals, identifying who initiated a request, which network is involved and what will change matters more than moving quickly. Approval target tells you what is being reviewed now, while Allowance and Contract address provide context for whether the next action makes sense. Before proceeding, confirm that the wallet and network are the ones you intended to use, then review the address, contract or request origin. If the purpose is unclear or the network does not match, stop rather than guessing.

A reliable Token Approvals workflow keeps verifiable references such as the network name, address or contract address, transaction hash, block-explorer status and the exact permission being requested. Asset names and icons are useful hints but are not a substitute for on-chain identifiers. With Approval target, avoid confirming something simply because it looks familiar; spoofed pages, wrong networks and malicious requests are designed to exploit that shortcut.

After an action involving Approval target, review the result. If a transaction was created, use its hash to check broadcast, block inclusion and confirmations. If a DApp session or approval was created, identify the connected origin and permission scope, and consider disconnecting or revoking access when it is no longer needed. This turns a one-time action into a process you can verify later.

What to review in practice

  • Confirm the active network is the one you intended and understand how Approval target relates to the action.
  • Verify addresses, contracts and request origins rather than trusting names or icons alone.
  • Before submission, review amount, gas, approval scope or signature details; afterward, keep verifiable on-chain references.

How Allowance changes the workflow

To understand Allowance, place it back inside the full Token Approvals workflow. Allowance tells you what is being reviewed now, while Contract address and Risk scope provide context for whether the next action makes sense. Before proceeding, confirm that the wallet and network are the ones you intended to use, then review the address, contract or request origin. If the purpose is unclear or the network does not match, stop rather than guessing.

A reliable Token Approvals workflow keeps verifiable references such as the network name, address or contract address, transaction hash, block-explorer status and the exact permission being requested. Asset names and icons are useful hints but are not a substitute for on-chain identifiers. With Allowance, avoid confirming something simply because it looks familiar; spoofed pages, wrong networks and malicious requests are designed to exploit that shortcut.

After an action involving Allowance, review the result. If a transaction was created, use its hash to check broadcast, block inclusion and confirmations. If a DApp session or approval was created, identify the connected origin and permission scope, and consider disconnecting or revoking access when it is no longer needed. This turns a one-time action into a process you can verify later.

What to review in practice

  • Confirm the active network is the one you intended and understand how Approval target relates to the action.
  • Verify addresses, contracts and request origins rather than trusting names or icons alone.
  • Before submission, review amount, gas, approval scope or signature details; afterward, keep verifiable on-chain references.

Build a review sequence around Contract address

To understand Contract address, place it back inside the full Token Approvals workflow. Contract address tells you what is being reviewed now, while Risk scope and Revocation provide context for whether the next action makes sense. Before proceeding, confirm that the wallet and network are the ones you intended to use, then review the address, contract or request origin. If the purpose is unclear or the network does not match, stop rather than guessing.

A reliable Token Approvals workflow keeps verifiable references such as the network name, address or contract address, transaction hash, block-explorer status and the exact permission being requested. Asset names and icons are useful hints but are not a substitute for on-chain identifiers. With Contract address, avoid confirming something simply because it looks familiar; spoofed pages, wrong networks and malicious requests are designed to exploit that shortcut.

After an action involving Contract address, review the result. If a transaction was created, use its hash to check broadcast, block inclusion and confirmations. If a DApp session or approval was created, identify the connected origin and permission scope, and consider disconnecting or revoking access when it is no longer needed. This turns a one-time action into a process you can verify later.

What to review in practice

  • Confirm the active network is the one you intended and understand how Approval target relates to the action.
  • Verify addresses, contracts and request origins rather than trusting names or icons alone.
  • Before submission, review amount, gas, approval scope or signature details; afterward, keep verifiable on-chain references.

Risks and common mistakes involving Risk scope

To understand Risk scope, place it back inside the full Token Approvals workflow. Risk scope tells you what is being reviewed now, while Revocation and Approval target provide context for whether the next action makes sense. Before proceeding, confirm that the wallet and network are the ones you intended to use, then review the address, contract or request origin. If the purpose is unclear or the network does not match, stop rather than guessing.

A reliable Token Approvals workflow keeps verifiable references such as the network name, address or contract address, transaction hash, block-explorer status and the exact permission being requested. Asset names and icons are useful hints but are not a substitute for on-chain identifiers. With Risk scope, avoid confirming something simply because it looks familiar; spoofed pages, wrong networks and malicious requests are designed to exploit that shortcut.

After an action involving Risk scope, review the result. If a transaction was created, use its hash to check broadcast, block inclusion and confirmations. If a DApp session or approval was created, identify the connected origin and permission scope, and consider disconnecting or revoking access when it is no longer needed. This turns a one-time action into a process you can verify later.

What to review in practice

  • Confirm the active network is the one you intended and understand how Approval target relates to the action.
  • Verify addresses, contracts and request origins rather than trusting names or icons alone.
  • Before submission, review amount, gas, approval scope or signature details; afterward, keep verifiable on-chain references.

Turn Revocation into a repeatable habit

To understand Revocation, place it back inside the full Token Approvals workflow. Revocation tells you what is being reviewed now, while Approval target and Allowance provide context for whether the next action makes sense. Before proceeding, confirm that the wallet and network are the ones you intended to use, then review the address, contract or request origin. If the purpose is unclear or the network does not match, stop rather than guessing.

A reliable Token Approvals workflow keeps verifiable references such as the network name, address or contract address, transaction hash, block-explorer status and the exact permission being requested. Asset names and icons are useful hints but are not a substitute for on-chain identifiers. With Revocation, avoid confirming something simply because it looks familiar; spoofed pages, wrong networks and malicious requests are designed to exploit that shortcut.

After an action involving Revocation, review the result. If a transaction was created, use its hash to check broadcast, block inclusion and confirmations. If a DApp session or approval was created, identify the connected origin and permission scope, and consider disconnecting or revoking access when it is no longer needed. This turns a one-time action into a process you can verify later.

What to review in practice

  • Confirm the active network is the one you intended and understand how Approval target relates to the action.
  • Verify addresses, contracts and request origins rather than trusting names or icons alone.
  • Before submission, review amount, gas, approval scope or signature details; afterward, keep verifiable on-chain references.
Security principle: Users remain responsible for their seed phrases and private keys. imtoken will never ask for a seed phrase, private key or verification code. Third-party DApps and smart contracts can carry risk, so review each signature and approval separately.

Related reading

Ready to use imtoken?

All download actions go through the dedicated download page.

Download imtoken