# Permit2

Permit2 is Uniswap's shared token-approval contract, and in phishing it is abused to obtain one signature that lets the attacker move several tokens the victim has already approved to Permit2.

## How it works

Many users approve Permit2 once so that dApps can then request signature-based transfers. A drainer asks for a Permit2 batch signature (PermitBatch or PermitTransferFrom) that names the attacker as spender.

Because the on-chain approval to Permit2 already exists, a single off-chain signature is enough to empty every token covered by it.

## How to protect yourself

- In a Permit2 request, read the spender and the token list; a batch covering many tokens on an unfamiliar site is a strong warning sign.
- Remove the Permit2 approval for tokens you do not trade actively.

## Related tools

- [Signature Request Inspector](https://phishdestroy.io/developer-tools/sign-inspector)

## Related terms

- [Permit phishing](https://phishdestroy.io/glossary/permit-phishing/)
- [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/)

## Further reading

- [Crypto Drainer Anatomy: $1.93B Stolen](https://phishdestroy.io/crypto-drainer-anatomy)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/permit2/