What is Permit2?
How it works
The standard ERC-20 flow requires a separate on-chain approval transaction for every application you authorize, and interfaces historically requested unlimited allowances that stayed open forever. ERC-2612 ("permit") introduced gasless signature approvals, but only for tokens whose contracts implement it — many widely used tokens, including WETH, never did.
Permit2, deployed by Uniswap Labs in November 2022 at the same address across EVM chains, sits between the token and the app. You approve Permit2 once per token; after that, individual apps are authorized by EIP-712 typed-data signatures naming the spender, the exact amount, a nonce, and an expiration. It supports two modes: AllowanceTransfer creates a standing, time-bounded allowance for an app, while SignatureTransfer authorizes a single transfer whose nonce is consumed on use, so the signature cannot be replayed.
When you trade through an integrated router, the signature travels inside the swap transaction itself — Permit2 verifies it, updates or consumes the allowance, and pulls the tokens. No extra approval transaction is needed, and grants expire on their own instead of lingering indefinitely. Users can also revoke outstanding grants in batch via Permit2's lockdown function or standard allowance-management tools.
Why it matters
Token approvals are one of DeFi's biggest silent risks: large sums sit behind forgotten unlimited allowances to contracts that may later be exploited. Permit2 replaces per-app forever approvals with scoped, expiring, signature-based ones and removes a gas-costing transaction from most flows. Because one shared deployment is reused across apps and chains, a single approval carries over everywhere Permit2 is integrated. The trade-off is a new attack surface: once a token is approved to Permit2, one off-chain signature can move those tokens, and phishing sites have drained wallets by tricking users into signing malicious Permit2 messages. Reading what a signature grants — spender, amount, deadline — is now core wallet hygiene.
Real-world examples
Uniswap's Universal Router, launched in November 2022, made Permit2 the default approval path. A trader swapping USDC for ETH approves USDC to Permit2 once; every later swap simply includes an EIP-712 signature naming the router, the exact amount, and a deadline inside the swap transaction itself. When Uniswap shipped newer router versions, users needed no fresh approval transactions — the same Permit2 approval carried over, with each grant scoped and expiring rather than unlimited.
FAQ
How is Permit2 different from ERC-2612 permit?
ERC-2612 builds signature approvals into the token contract itself, so it only works for tokens that implement it (USDC does; WETH does not). Permit2 is a separate shared contract that retrofits signature-based, expiring approvals onto any ERC-20: you approve Permit2 once on-chain, and it enforces the signed sub-allowances for individual apps.
Can Permit2 signatures be used to steal funds?
Yes — that is the main risk. If you have already approved Permit2 for a token, signing a malicious Permit2 message on a phishing site can grant an attacker an allowance without any on-chain transaction from you. Always check the spender address, amount, and deadline in your wallet's signature preview, and periodically review and revoke allowances with a tool like Revoke.cash.
Do Permit2 approvals expire?
Allowance-style grants carry an expiration timestamp set by the app, typically days to weeks rather than forever, and signature-transfer grants are single-use because their nonce is consumed. However, the initial on-chain approval of the token to the Permit2 contract itself is usually unlimited and never expires — that is the approval to revoke if you want to fully exit.
Related terms
Go deeper
Browse the complete crypto glossary to explore related terms and concepts.
Browse Glossary