Technical reference
Permit2: token approval and downstream signatures are separate permissions
Review the token's allowance to Permit2 and the spender authority granted through Permit2.
Rechercheartikel und Referenzeinträge erscheinen auf Englisch. Die Navigation ist in sieben Sprachen verfügbar.
The first permission layer
Permit2 is a contract system that supports signature-based token transfers and managed approvals. The underlying ERC-20 token must permit the Permit2 contract to move the relevant assets. That token allowance is distinct from what a user authorises through Permit2.
Two transfer mechanisms
SignatureTransfer supports one-time signature-based transfers. AllowanceTransfer manages spending allowances with amounts and expiration. Their scope and lifecycle differ. Calling both a harmless login signature conceals the financial authority the message may confer.
Review both layers
Record the chain, Permit2 deployment, underlying token, downstream spender, amount and time or nonce constraints. Check the intended recipient and the exact application flow. Reducing a token allowance may block a transfer but does not explain every outstanding application signature. Conversely, removing one application's permission should not be assumed to remove the underlying token allowance. A useful incident record identifies which layer was changed.