What is approveForAll?
For ERC-20 tokens, an approval is per token: you allow a spender to move a certain amount of one token. NFTs work differently. To let a marketplace move an NFT on your behalf, you call setApprovalForAll — a single switch that grants an operator control of every NFT in that collection that you own or later acquire.
Why it exists
It saves gas and clicks: approve once, then list and sell many items without re-approving each time. That convenience is exactly what makes it dangerous.
The risk
- If the operator contract is exploited or malicious, it can transfer your entire collection.
- It is permanent until you revoke it — the operator does not need your signature again.
- Phishing sites often request
setApprovalForAlldisguised as a simple login or claim.
How to revoke it
Revoking is the same call with approved = false. Most wallets and revoke tools can do it; you sign the transaction and pay only gas. Shingan detects new ApprovalForAll events on your wallets and alerts you with a revoke link.