In this track: Smart contract security foundations
advanced · 4 MIN READ
Approval race conditions
Replacing an allowance can interact with pending spending.
LET’S PICTURE IT
Changing a permission limit while an earlier permission is still usable creates an ordering problem.
SEE IT FOR YOURSELF
From a public address to a verified signatureStep 1 / 4
An address is public receiving information. It is not the private key that authorizes actions.
An address is public receiving information. It is not the private key that authorizes actions.The local signing system uses secret authorization material. It produces a signature; the private key is not sent along with it.A verifier checks the signed request under the account’s rules. A valid signature does not by itself prove that the action is safe.Balances belong to network state. A wallet is an interface and signing system, not a box containing coins.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Understand replacement semantics
A standard approve call replaces the allowance with a new value. It does not necessarily mean add exactly this much permission to what remains.
Consider transaction ordering
A spender may use an existing allowance before a replacement is included. The resulting total spending can differ from a user’s simple before-and-after expectation.
Review safer workflows
Zeroing before a later nonzero approval can address a known transition issue, but pending use of the old permission still needs to be understood. Token-specific increase or permit mechanisms have their own rules.
Explain the actual authority
Show the spender, network, token and intended amount. An interface should describe permission changes without promising that a UI action cancels already included spending.
Reason about the scenario
old allowance 10
spender uses old permission before replacement
new approve 20 is included
Reason about ordering, not just the final displayed number.
Pseudocode or a simplified scenario for local reasoning. This is not a production contract or a completed security review.
QUICK CHECK · NO PRESSURE
Does a later approval undo spending already included?
An allowance update does not reverse earlier successful actions.