Cowswap Cowswap token approvals, spending allowances and signed orders
Cowswap token approvals give the vault relayer permission to transfer a sell token from your wallet during order settlement. The allowance names a spender and a spending limit for that token. Your order authorization supplies the trading terms the settlement contract must enforce. Approval alone does not submit a trade, reserve your balance or transfer tokens to a solver.
The allowance and the order govern different parts of the same trade. Understanding their relationship explains which address receives spending permission, what an unlimited approval permits and why an expired order can leave an allowance behind.
The token contract, vault relayer and settlement
The token contract records the allowance, GPv2VaultRelayer uses it to collect sell tokens and GPv2Settlement enforces the authorized order before completing the trade. The trading interface prepares requests for your wallet; it does not itself hold the ERC-20 allowance. That permission belongs to the account, token contract and spender on the selected network.
For a direct ERC-20 transfer, the relayer calls the token’s
transferFrom
function on the owner’s behalf. It sends the sell tokens to the settlement contract, which coordinates the trade and distributes its proceeds. Only the settlement contract can invoke the relayer’s token-transfer functions. A solver submits a settlement through the protocol, without receiving its own spending allowance over your wallet.
An allowance paired with a signed order
A usable allowance supplies access to the sell token, while an authorized order specifies the trade the protocol may execute using that access. The settlement contract checks the order’s authorization, expiry and price condition. It also tracks execution to prevent overfilling, but zero-amount orders can permit repeated fee collection. Do not sign an order with a zero sell or buy amount. A large allowance does not enlarge the signed order’s sell amount or relax its acceptable exchange terms.
This separation lets solvers seek liquidity without asking you to approve each proposed route. They can perform external contract interactions during settlement, but the settlement contract forbids those interactions from targeting the vault relayer. Its controlled transfer path preserves the connection between access to wallet tokens and the authorized trade. Approving the settlement contract directly would bypass that intended separation.
The allowance supplies no execution deadline of its own under standard ERC-20 rules. An order’s expiry limits that order, leaving any unused token allowance in place.
The spender address in an approval request
On Ethereum, GPv2VaultRelayer uses the address
0xC92E8bdf79f0507f65a392b0ab4667716BFE0110.
An address identifies a deployment on a particular network, so its context matters alongside its spelling. In a standard approval transaction, the transaction target is the sell-token contract. The spender appears inside the approval’s arguments. Those fields identify different contracts, even when a wallet presents them together.
An approval review therefore concerns the selected network, token contract, token-owning account, spender and allowance amount. A token symbol or app logo cannot establish those relationships. The recipient in the later order has another role: it receives the bought tokens. A correct approval does not correct an unintended recipient, because the order signature covers the recipient separately.
Limited allowances and continuing permission
A finite allowance caps the spender’s remaining access to a particular token; an unlimited allowance leaves enough permission for repeated trades without repeated allowance updates. Neither choice changes the contract responsible for spending.
A capped allowance
For predictable inputs, the cap needs to cover the full sell-token debit the order permits. In the settlement contract, that debit includes the executed sell amount and any applicable sell-token fee. A cap covering only the trade amount can be insufficient when the order includes such a fee. Standard finite-allowance spending reduces the remaining allowance, so a later trade may require an update.
An unlimited allowance
For tokens using the maximum-value convention, an unlimited approval grants the largest allowance the contract supports. Some ERC-20 implementations preserve that value across transfers. This avoids repeated approval transactions, but leaves continuing permission over that token, including later deposits into the same account. The settlement contract’s order checks still apply. Unlimited permission does not mean a signed order can sell more than its terms allow.
A capped allowance matched to one order
In this hypothetical case, a reader asks whether approving 73 token units lets one order debit 43 units. Assume the ERC-20 token reduces finite allowances by the transferred amount and debits the wallet by that same amount. The wallet holds enough tokens, and no competing transaction changes its balance or allowance. The 43-unit debit includes any applicable sell-token fee; the order also has valid authorization and satisfies its settlement conditions.
The allowance provides room for the 43-unit debit, while the order supplies the terms governing that debit. After successful full settlement, the remaining allowance is 73 minus 43, or 30 token units. The wallet’s sell-token balance falls by 43 units, and the designated recipient receives the buy-token proceeds under the order’s terms. The unused 30 units represent permission, not tokens held by the relayer.
This outcome relies on the stated token behavior and unchanged inputs. Another trade needing more than 30 units would exceed the remaining allowance. Changing the approved amount changes that ceiling without changing the existing order’s terms.
Approval transactions and gasless permits
An on-chain approval updates the token contract directly, while a supported permit lets a signed message authorize that update when someone submits the message on-chain. Both methods can create spending permission. Their wallet prompts, gas requirements and compatibility differ.
An on-chain allowance update
A conventional approval transaction calls the sell-token contract to set the spender’s allowance. Submitting or signing the transaction does not establish a confirmed allowance update. Network confirmation and the resulting allowance establish whether the change succeeded. This transaction consumes gas independently of whether a later trade finds an execution route. Reusing sufficient existing permission avoids another allowance update.
A permit signature
Tokens supporting compatible permits can use Cowswap’s gasless approval flow for market and limit orders. The token must support the required signature mechanism. For an ERC-2612 permit, the signed fields include the owner, spender, value, nonce and deadline. Its verifying contract is the token contract. That differs from an order signature, whose signing domain identifies the settlement contract.
Smart contract wallet batches
The app’s gasless token-approval flow excludes smart contract wallets. A separate Safe app integration can combine an approval and on-chain order placement in one Safe transaction. Combining calls preserves their distinct purposes: one grants token access and the other authorizes an order. Contract-wallet order authorization therefore does not imply compatibility with a token’s permit implementation.
Why does a trade still need approval after an earlier confirmation?
An earlier approval can leave insufficient permission if it covers another account, token contract, network or spender, or if previous spending reduced its remaining amount. Allowance and balance are separate quantities. A wallet can hold enough tokens with too little allowance, or have ample allowance with too few tokens. Neither state supplies the other missing requirement.
A pending approval also leaves the existing on-chain permission unchanged until execution. A failed transaction does not create the requested allowance. When an approval display appears inconsistent, the token contract’s current
allowance(owner, spender)
value describes the remaining permission. An old approval event records a past update; later approvals or spending may have changed the value. A confirmed allowance update also does not establish that an order has traded.
Revocation and outstanding order permissions
Revoking a standard token approval means setting the allowance for that owner and spender to zero on the token contract. The change concerns that permission, so its effect depends on which funding route an order uses. A direct wallet-token order cannot draw through the revoked allowance while it remains zero. The revocation itself requires an on-chain update and consumes gas.
Disconnecting a wallet from Cowswap does not change an ERC-20 allowance stored on-chain. Closing the browser also leaves that permission intact. Revocation and order cancellation affect different records: removing token access does not invalidate the signed order. Restoring an allowance can make an outstanding order executable again if its authorization, expiry, balance and other conditions still permit execution.
An unused ERC-2612 permit can update the allowance later if its nonce and deadline remain valid. Setting the current allowance to zero does not itself consume that permit’s nonce. Current permission and an unsubmitted approval signature therefore require separate consideration. An allowance reading describes the current state, without proving every previously signed permit has become unusable.
Direct allowances and Balancer balance modes
Integrations using Balancer V2 can draw on external or internal Vault balances, which require permissions different from a direct token allowance to the relayer. The order’s
sellTokenBalance
field selects its funding mode.
Wallet tokens with direct approval
The
erc20
mode uses the owner’s wallet token balance and a token allowance to GPv2VaultRelayer. An allowance checker for the token-owner-spender combination describes this permission. It does not describe the separate relayer authorization the Balancer Vault maintains.
External Balancer balances
The
external
mode uses an ERC-20 allowance to the Balancer Vault together with the user’s authorization of the vault relayer. The Vault must also recognize the relayer as authorized. This combination lets the relayer request transfers using the Vault’s existing token allowance. Reviewing only a direct allowance to GPv2VaultRelayer would miss that permission path.
Internal Balancer balances
The
internal
mode draws from token balances the Vault already accounts for internally and requires both the user’s relayer approval and the Vault’s authorization of the relayer. Its available balance differs from the tokens sitting directly in the wallet. These are protocol-level funding modes; a particular interface may expose only some of them. The user’s Balancer relayer approval applies across tokens; external transfers still require each token’s allowance to the Vault.
Contract safeguards and misleading approval screens
The non-upgradeable settlement and vault-relayer contracts preserve their deployed code, but their safeguards apply to requests involving those contracts and valid order terms. A misleading interface can request permission for a different spender. Attackers hijacked the frontend’s domain on April 14, 2026 and presented phishing requests for malicious transactions.
Wallet approval details identify the contract receiving permission even when the surrounding screen looks familiar. A signature authorizing another spender does not acquire the vault relayer’s restrictions merely because it accompanies a trading form. Likewise, an order authorizing an unintended recipient can direct proceeds there under its signed terms. Leaving an unexplained approval unsigned avoids granting that spender new token access.
Common questions about Cowswap
Must I approve the buy token before receiving it in my wallet?
Receiving an ordinary ERC-20 buy token through the wallet-balance route does not require an allowance from the recipient. Spending allowances authorize transfers out of an owner’s account. The settlement contract sends the proceeds to the order’s recipient. Selling those received tokens later can require a separate allowance for their token contract.
Can a token require a zero allowance before approving a new amount?
Some token implementations require the existing allowance to reach zero before accepting a new nonzero allowance. This token-specific behavior can make a direct increase fail despite sufficient gas and balance. A reset changes spending permission; it does not move tokens or authorize a trade. The application’s handling of that requirement determines the calls your wallet receives.
Does an ERC-2612 permit’s deadline also expire the resulting allowance?
An ERC-2612 permit deadline limits when the token contract can accept that permit, rather than when the resulting standard allowance expires. Once a valid submission sets the allowance, the token’s spending and approval rules govern its remaining value. Other permit implementations can have different semantics, so the same expiry interpretation does not cover every signed approval.
Will revoking an approval recover tokens already transferred?
Revoking an allowance cannot reverse a token transfer the spender already completed. It changes the permission available for later transfers through that allowance. A confirmed reduction therefore addresses remaining access, without restoring a previous balance. The effectiveness of a revocation also depends on whether it executes before any competing authorized transfer.
Which signing request can show the name Gnosis Protocol?
A CoW Protocol order-signing request can show Gnosis Protocol as its signing-domain name. The protocol retains this name from Gnosis Protocol v2 because changing it would require a new settlement deployment. That name concerns order authorization. A token permit uses its token’s signing domain, and the domain name alone does not establish a correct request.