What is Permit2 and how do Permit2 approvals work?

Permit2 is a smart contract from Uniswap Labs that manages how apps get permission to spend your tokens. Instead of sending a separate approval transaction to every app, you approve Permit2 once for a token, and apps then request access through signatures that Permit2 checks. It is part of how Uniswap handles token permissions.

What is a token allowance?

On Ethereum and similar chains, an app cannot pull ERC-20 tokens from your wallet unless you grant it an allowance. Uniswap's November 2022 launch post explained two problems with the old way. Every new app needed its own approval transaction, which cost gas, and many apps asked for an unlimited allowance that stayed in place indefinitely. If such an app was later exploited, tokens could be stolen through that standing approval.

An earlier standard, EIP-2612, let tokens grant allowances by signature, but only tokens built with that feature support it. Permit2 brings signature-based approvals to any ERC-20 token.

How do Permit2 approvals work?

The first step is a normal on-chain approval that lets the Permit2 contract handle a given token. After that, permissions are granted by signing messages. The Uniswap docs describe two modes.

• Signature transfer. A one-time signature lets a spender move tokens in a single transaction, and no standing allowance is left behind.
• Allowance transfer. The signature sets an allowance with an amount and an expiration, and the spender can use it repeatedly until it runs out or expires.

The docs list the main Permit2 address as 0x000000000022D473030F116dDEE9F6B43aC78BA3 on the chains Uniswap supports, with a different address on zkSync. Uniswap's launch post described the contract as non-upgradable, unowned and open source.

How does a Permit2 signature scam work?

Signing a message does not cost gas, so it can feel harmless. Our guide on signing a message explains why some signatures carry real power. A Permit2 signature is one of them. It can authorize a spender to move your tokens.

Decrypt reported that in October 2024 a wallet lost about $1.39 million in PEPE and other tokens after its owner signed an off-chain Permit2 message, according to the security firm ScamSniffer. The victim saw nothing unusual on chain until the attacker moved the tokens. In July 2026, The Cryptonomist reported a trader losing roughly $1 million the same way, stressing that no protocol was hacked. The signer was simply deceived.

Decrypt noted that these scams typically arrive through phishing websites or fake app interfaces, as covered in phishing and wallet drainers. Reading the spender, token and amount in the wallet prompt before signing is the main defense.

Can you revoke a Permit2 approval?

Yes. Uniswap's launch post said Permit2 lets users revoke allowances, including several tokens and spenders in one transaction, and it urged users to revoke active allowances they no longer need. The original on-chain approval that lets Permit2 handle a token can also be cancelled like any other allowance. The steps are in our guide on how to revoke token approvals.