You might have seen the news on the new permit2 exploit that's been posted on the news and on many crypto-related subreddits.
This article will explain how the exploit works and how to stay safe from it in a short and easy way people understand.
Permit2 is a smart contract that users need to give an unlimited approval to. After approving the Permit2 contract, it can be used to grant sub-approvals to other smart contracts. This can be done through a Permit2.approve() function, which works in a similar way as the approve() function on ERC20 tokens. But it can also be done through a Permit2.permit() function, which works like the EIP2612 permit() function.
Hackers' Strategy: They create fake tokens, like “NeiraETH” or meme coins, to trick users. The goal is to get you to approve their token’s contract, which then allows them to drain other Permit2 tokens from your wallet.
How It Works:
You see a new coin (let's name it NeiraETH) that’s “pumping” in price.
After seeing gains, you decide to sell, but you need to approve the token on a DEX like Uniswap or PancakeSwap.
Hackers pump their own coin to create excitement and trick people into approving it.
The Trap: By approving the contract, you unknowingly grant the hacker access to all your other Permit2 tokens, such as Pepe, Shiba, USDC, Wrapped Ether, DAI, AAVE, and other tokens using the same approval method.
What Happens Next:
Once enough users approve the contract, hackers stop the pump, halt all marketing, and even create “FUD” (fear, uncertainty, doubt) to encourage people to sell.
Finally, they trigger the exploit and drain funds from every wallet that approved the contract.
Why This Is So Risky:
This exploit impacts many popular tokens using Permit2 contracts.
Decentralized finance means that, once a contract is launched, it can’t be changed, making this exploit a long-term risk.
Pepe Holder Loses $1.4 Million in Uniswap Permit2 Phishing Attack
The victim unknowingly signed an Permit2 signature, which granted the attacker unrestricted access to their wallet, according to ScamSniffer.
How to Protect Yourself from the Permit2 Exploit:
Use Revoke.Functions: Go to
https://revoke.approvals.cash/ and revoke any approvals you’ve made, especially on small, low-cap meme coins or new tokens.
Focus on Recent Interactions: If you’ve interacted with newly created tokens in the past month, it’s wise to revoke their permissions to prevent hackers from accessing other assets in your wallet.
Taking these steps can help safeguard your wallet from potential future attacks.