The signature you couldn't undo

February 2025. A holder in Boston clicks a Twitter ad for a "BAYC season 2 free claim." The site looks like OpenSea, asks her to connect her wallet, and prompts a signature labeled "Confirm airdrop eligibility." The signature is a setApprovalForAll on her ERC-721 contract. She signs.

Within four minutes, three Bored Apes, one Pudgy Penguin, and a Doodle leave her wallet. Total floor-price loss at the time: $137,000.

What setApprovalForAll actually does

It is a single function call on an ERC-721 or ERC-1155 contract that grants a third-party address permission to transfer every NFT of that collection that you currently hold, or will ever hold, until you revoke. Once granted, the operator can call transferFrom with no further interaction from you. The signature does not look unusual in MetaMask — it just shows the contract address and the word "approve."

The three signals on the signature screen

  • "setApprovalForAll" is almost never legitimate for an airdrop. Real airdrops use either a Merkle-claim function (you sign a transaction calling claim, no approval needed) or a transferFrom from the project's own wallet (you sign nothing). If a "claim" page asks for setApprovalForAll, close the tab.
  • The operator address should be the contract you trust. Look at who you are approving. If it is a random EOA (externally owned account) and not the verified NFT marketplace, that is the drainer wallet.
  • MetaMask shows a warning since version 11. A red banner appears for high-risk approvals. Do not click through it.

If you already signed

Go to revoke.cash or etherscan.io/tokenapprovalchecker immediately. Connect the affected wallet. Find every approval to non-marketplace addresses and revoke them. Each revoke is a transaction with gas — budget $20–50 in ETH. If the drainer has not yet moved the NFTs, you can save them. The race is usually under five minutes; mobile is faster than desktop here.

The standing rule

I review my approvals on revoke.cash once a month. I keep a screenshot of the previous month's list. Anything new that I did not consciously authorize gets revoked the same hour.