Permit2

Permit2 is a token approval contract that acts as a shared allowance manager. Instead of approving each DEX contract individually, users approve tokens to Permit2 once, then grant fine-grained permissions to specific spenders (like the Universal Router).

Why Permit2?

Traditional ERC-20 approvals have several problems:

Problem	Permit2 Solution
Unlimited approvals to every dApp	Single approval to Permit2, then scoped sub-permissions
No expiration on approvals	Sub-permissions have configurable expiration
Each new dApp needs a new approval tx	Permit2 already approved, only a sub-permission needed
Revocation requires per-dApp transactions	Revoke Permit2 approval to cut off all dApps at once

How It Works

Step 1 (one-time per token):
  Token ──approve──▶ Permit2

Step 2 (one-time per token per spender):
  Permit2 ──approve──▶ Universal Router
  (with amount limit + expiration)

Step 3 (every swap):
  Universal Router uses Permit2 to transfer tokens

Step 1: Approve Token to Permit2

Standard ERC-20 approve(). Only needs to happen once per token.

token.approve(PERMIT2, type(uint256).max);

Step 2: Grant Permission via Permit2

Call Permit2.approve() to let the Universal Router spend your token through Permit2:

permit2.approve(
    tokenAddress,       // Which token
    UNIVERSAL_ROUTER,   // Who can spend it
    type(uint160).max,  // Amount limit
    expiration          // When this permission expires (unix timestamp)
);

Step 3: Swap Execution

When the Universal Router executes a swap, it pulls tokens from the user via Permit2 — no further user interaction required.

Checking Allowances

Query existing permissions:

(uint160 amount, uint48 expiration, uint48 nonce) = permit2.allowance(
    owner,           // User address
    tokenAddress,    // Token
    spender          // e.g., Universal Router
);

A swap will fail if:

amount is less than the swap input
expiration is in the past

Security Benefits

Scoped permissions: Each spender gets its own allowance with its own expiration
Single revocation point: Revoking the ERC-20 approval to Permit2 disables all downstream spenders
Nonce tracking: Prevents replay attacks
Expiration: Permissions automatically become invalid after the set time

Overview

V2 Protocol

V3 Protocol

Infrastructure

Reference

Permit2

Permit2

Why Permit2?

How It Works

Step 1: Approve Token to Permit2

Step 2: Grant Permission via Permit2

Step 3: Swap Execution

Checking Allowances

Security Benefits

​Permit2

​Why Permit2?

​How It Works

​Step 1: Approve Token to Permit2

​Step 2: Grant Permission via Permit2

​Step 3: Swap Execution

​Checking Allowances

​Security Benefits

Permit2

Why Permit2?

How It Works

Step 1: Approve Token to Permit2

Step 2: Grant Permission via Permit2

Step 3: Swap Execution

Checking Allowances

Security Benefits