I found that "contract unlimited authorization" is like sleeping: you think you're not sleepy, but if you stay up long enough, unexpected things can happen... Anyway, now I always go and revoke the allowance after each interaction, otherwise if the project team changes parameters or steals permissions one day, whatever remains in the wallet is just luck.

Last night I really found a detail: I previously gave a certain DEX routing contract unlimited access, but later it upgraded and changed its implementation, and the old authorization was still there. On-chain, it looks like approve(spender=0x9f…c2, amount=2**256-1), which is terrifying the more I look at it. Even more crazy is that some on-chain data tools/tag systems still label it as "safe" or "well-known," but honestly, these tags are as outdated as weather forecasts, and can even be misleading. It’s fine to watch from the sidelines, but trusting them as security boundaries is just ridiculous.

I won’t pretend; when I’m lazy, I think "Forget it, just leave it," but revoking permissions is really like brushing your teeth—doing it might not save you immediately, but at least it gives peace of mind.