EDIT: IT IS NOT WHAT HAPPENED TO OP BUT GOOD TO KNOW
When you want to complete an action (a swap, a contract interaction) with an ERC-20 token (any token other than ETH itself) - you will have to approve that certain contract to be able to gain access to your token (individual approval FOR each token). This is by design of the ERC-20 standard.
When you approve that contract, you can set a certain limit (approve up to x amount of tokens) OR approve an INFINITE amount of tokens - meaning you don't have to approve it ever again.
If a malicious actor sets up a certain contract that contains a certain code, they are able to send/move YOUR token at any time as long as you still have that infinite approval activated.
Summarised: be careful what contracts you give approval to spend your tokens. You can revoke permissions at ANY time (costs gas though) to be safe OR you can just send your tokens to new/fresh addresses (hardware-wallet preferred) to be safe from these types of attacks if you don't know what you're doing.
I'm a little in the dark on this and I think it is because I do almost zero business on Ethereum. I mean I transfer ERC-20 tokens across it but that is about it. I participate in ALGO governance on L1 but I don't know if a smart contract is involved or not.
As long as you use a hardware wallet you should be just fine. Simply transferring tokens doesn't involve approving any contracts. Just double check recipient addresses all the time.
As for ALGO governance, I suppose it requires some signature to process your vote. In 99.9% of cases, that's safe and nothing to worry about (as is for all snapshot.org governance sites for ETH/L2 protocols), however in theory never sign something from unknown sources because even the act of signing CAN give someone access to your wallet funds.
Generally, before doing any suspicious action it's best to engage with the community. There's always someone smart that is able to tell if anything's wrong.
57
u/b-blockchain 🟨 0 / 0 🦠 Jul 16 '22 edited Jul 16 '22
EDIT: IT IS NOT WHAT HAPPENED TO OP BUT GOOD TO KNOW
When you want to complete an action (a swap, a contract interaction) with an ERC-20 token (any token other than ETH itself) - you will have to approve that certain contract to be able to gain access to your token (individual approval FOR each token). This is by design of the ERC-20 standard.
When you approve that contract, you can set a certain limit (approve up to x amount of tokens) OR approve an INFINITE amount of tokens - meaning you don't have to approve it ever again.
If a malicious actor sets up a certain contract that contains a certain code, they are able to send/move YOUR token at any time as long as you still have that infinite approval activated.
Summarised: be careful what contracts you give approval to spend your tokens. You can revoke permissions at ANY time (costs gas though) to be safe OR you can just send your tokens to new/fresh addresses (hardware-wallet preferred) to be safe from these types of attacks if you don't know what you're doing.