# Wallet Permission Explorer

> Who can move your tokens? Allowances, Permit2, NFT operators and EIP-7702 delegation, with risk. Checks a wallet's live token permissions straight from the chain: ERC-20 allowances for the major tokens against a verified list of well-known spenders (Uniswap Permit2 and routers, 1inch, 0x, CoW, Aave, OpenSea), Permit2 sub-allowances with expiry, NFT operator approvals for collections you list, and EIP-7702 account delegation. Flags unlimited approvals, approvals to plain wallets and to unverified contracts, and shows how much of your balance is exposed.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://walletpermissionexplorer.usefulweb.site/ (interactive tool at https://walletpermissionexplorer.usefulweb.site/tool)
- JSON API: POST https://walletpermissionexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://walletpermissionexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://walletpermissionexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://walletpermissionexplorer.usefulweb.site/mcp - tool `wallet_permission_explorer`

## Inputs
- mode (select): What do you have?
- chain (select): Chain
- owner (text): Wallet address (owner)
- extraTokens (list): Extra ERC-20 tokens to check - One token address per line (added to USDC/USDT/WETH/DAI on this chain).
- extraSpenders (list): Extra spenders / operators to check - One address per line, e.g. a contract you once approved.
- nftCollections (list): NFT collections (ERC-721/1155) to check - One collection address per line; checked with isApprovedForAll against marketplace operators and your extra spenders.
- approvalLogs (textarea): Approval / ApprovalForAll logs JSON (offline) - Array of {address, topics, data, blockNumber?, logIndex?} as returned by eth_getLogs.
- currentAllowances (textarea): Current allowance values JSON (offline, optional) - Array of {token, spender, allowance} overriding the log values (e.g. after partial spending).

## Method
- ERC-20: allowance(owner, spender) via eth_call for USDC/USDT/WETH/DAI (official addresses per chain) plus your extra tokens, against a list of spenders whose addresses were checked against official deployment lists and Sourcify-verified contract names (Permit2, Uniswap Universal Router / V2 / V3 routers, 1inch v5/v6, 0x Exchange Proxy / AllowanceHolder, CoW VaultRelayer, Aave V3 Pool, Seaport, OpenSea Conduit) plus your extra spenders.
- Permit2: for tokens approved to Permit2, Permit2.allowance(owner, token, spender) returns (amount, expiration, nonce); only unexpired, non-zero sub-allowances are reported.
- NFTs: isApprovedForAll(owner, operator) for each collection you list against Seaport, the OpenSea Conduit and your extra spenders.
- EIP-7702: an account whose code is 0xef0100‖address is delegated to that address's code.
- Risk: unlimited = allowance ≥ 2^255 (ERC-20) or ≥ 2^159 (Permit2 uint160); spenders without code (EOAs) or without verified source are high risk; NFT operator approvals always carry at least medium risk.
- Exposure = min(allowance, current balance) × current DefiLlama USD price. Offline mode replays Approval/ApprovalForAll logs (latest value per token+spender wins, current values override).