什么是授权（Approve）？｜钱包与安全 · Web3Origin 链上学习学院

什么是授权（Approve）？What is approval (Approve)?

⏱ 7 分钟7 min

学习目标：学完你能用大白话说清授权是什么、为什么DApp需要它、「无限授权」的风险在哪，并知道该如何谨慎地给出授权。Learning goal: after this lesson you'll be able to explain in plain words what approval is, why a DApp needs it, where the risk of "unlimited approval" lies, and how to grant approvals carefully.

大白话In plain words授权就像你在银行给某个商户开了一个「可以从我账户里扣钱」的额度。额度开多大、开给谁，全看你点确认的那一下——开了无限额度，对方理论上能一直扣。Approval is like giving a merchant a "may charge my account" limit at the bank. How big the limit is and who gets it depends entirely on that one moment you click confirm — grant an unlimited limit and, in theory, they can keep charging forever.

授权（Approve）＝你允许某个智能合约，动用你钱包里某种代币的一定额度。为什么需要它？因为在DEX兑换、质押、买NFT这类操作里，合约要替你把代币从你钱包划走去完成交易，而它必须先得到你的许可。于是DApp会先弹一笔授权交易，你签了，它才有权限动这个币。Approval (Approve) = you allow a smart contract to spend a certain amount of one token in your wallet. Why is it needed? Because in operations like DEX swaps, staking, or buying an NFT, the contract has to move tokens out of your wallet on your behalf to complete the trade — and it must get your permission first. So a DApp pops up an approval transaction; only after you sign it does the contract get the right to touch that token.

关键在于额度。很多DApp默认申请「无限授权」（Unlimited），也就是不设上限地允许它花你这种代币。方便是方便——以后不用每次都重新授权——但风险也在这：只要这份授权还在，该合约（或控制它的人）理论上可以在任何时候把你这种代币全部划走。The key is the limit. Many DApps request "unlimited approval" by default — allowing them to spend your token with no cap. It is convenient — you won't have to re-approve every time later — but that's exactly where the risk is: as long as this approval stands, the contract (or whoever controls it) can, in theory, move all of that token out at any time.

授权和转账不是一回事：授权本身不动你的钱，只是发了一把「可动用的钥匙」给合约。危险在于这把钥匙可能被滥用，尤其当：Approval and transfer are not the same thing: approval itself doesn't move your money — it just hands the contract a "key that can spend". The danger is that this key may be abused, especially when:

你在钓鱼网站上误签了授权，对象其实是骗子合约You mistakenly sign an approval on a phishing site, and the target is actually a scam contract
你授权的合约本身有漏洞或藏了后门The contract you approved has a vulnerability or a hidden backdoor
无限授权长期挂着，早忘了当初授给过谁An unlimited approval sits there for a long time and you've long forgotten who you granted it to

更稳的习惯：能选额度时，只授权本次需要的数量而非无限；授权前看清弹窗里的代币、被授权的合约地址、额度三项；只在官方DApp里操作；用完某个协议后及时撤销授权（下一课会讲）。授权是DeFi的正常机制，不必恐惧，但要像开扣款额度一样心里有数。Safer habits: when you can choose the amount, approve only what this transaction needs rather than unlimited; before approving, check the three things in the popup — the token, the contract address being approved, and the amount; only operate inside official DApps; and revoke the approval once you're done with a protocol (covered in the next lesson). Approval is a normal DeFi mechanism — no need to fear it, but stay as clear-headed as you would when setting up a spending limit.

案例Example你在一个兑换网站想把100枚稳定币换成别的币，网站先让你签一笔授权。若你点了「无限」，就等于告诉这个合约「我这种稳定币你随便动」。日后哪怕你只想换10枚，它也始终握着划走你全部余额的权限，直到你主动撤销。On a swap site you want to trade 100 stablecoins for another token, and the site first asks you to sign an approval. If you click "unlimited", you're effectively telling the contract "help yourself to this stablecoin of mine". Even if later you only want to swap 10, it still holds the power to move your entire balance — until you actively revoke it.

配套工具（点开在主站打开）：Related tools (open on the main site):

📝 本节测验📝 Quiz

❓ 常见问题❓ FAQ

为什么很多DApp默认让我选「无限授权」？Why do many DApps default me to "unlimited approval"?

因为这样你以后重复使用时不必每次再签一次授权，体验更顺。但便利的代价是权限长期敞开，谨慎的用户会手动改成按需额度，或在用完后及时撤销。Because it means you won't have to re-sign an approval every time you use it again later, so the experience is smoother. But the price of that convenience is a permission that stays open long-term; careful users manually change it to an on-demand amount, or revoke it promptly once done.

只授权不转账，我的币会立刻少吗？If I only approve and don't transfer, will my tokens drop immediately?

不会。授权那一刻资产仍在你钱包里，减少的只是「可被该合约动用的权限余量」。真正的划转要等合约后续调用时才发生，风险正来自这个「后续」。No. At the moment of approval your assets are still in your wallet; what changes is only the "remaining permission the contract can spend". The actual movement happens only when the contract is called later — and the risk lies exactly in that "later".

怎么知道自己给哪些合约授过权？How do I know which contracts I've approved?

可以用钱包体检类工具或区块浏览器查看你地址下的授权清单，上面会列出被授权的合约和额度。看到陌生的或早已不用的授权，建议尽快撤销。You can use a wallet-checkup tool or a block explorer to view the list of approvals under your address, which shows the approved contracts and amounts. If you see unfamiliar or long-unused approvals, it's best to revoke them as soon as possible.