> ## Documentation Index
> Fetch the complete documentation index at: https://docs.krokoswap.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Permit2

> Unified token approval system for secure and efficient allowance management

# Permit2

**Permit2** is a token approval contract that acts as a shared allowance manager. Instead of approving each DEX contract individually, users approve tokens to Permit2 once, then grant fine-grained permissions to specific spenders (like the Universal Router).

## Why Permit2?

Traditional ERC-20 approvals have several problems:

| Problem                                   | Permit2 Solution                                        |
| ----------------------------------------- | ------------------------------------------------------- |
| Unlimited approvals to every dApp         | Single approval to Permit2, then scoped sub-permissions |
| No expiration on approvals                | Sub-permissions have configurable expiration            |
| Each new dApp needs a new approval tx     | Permit2 already approved, only a sub-permission needed  |
| Revocation requires per-dApp transactions | Revoke Permit2 approval to cut off all dApps at once    |

## How It Works

```
Step 1 (one-time per token):
  Token ──approve──▶ Permit2

Step 2 (one-time per token per spender):
  Permit2 ──approve──▶ Universal Router
  (with amount limit + expiration)

Step 3 (every swap):
  Universal Router uses Permit2 to transfer tokens
```

### Step 1: Approve Token to Permit2

Standard ERC-20 `approve()`. Only needs to happen once per token.

```solidity theme={null}
token.approve(PERMIT2, type(uint256).max);
```

### Step 2: Grant Permission via Permit2

Call `Permit2.approve()` to let the Universal Router spend your token through Permit2:

```solidity theme={null}
permit2.approve(
    tokenAddress,       // Which token
    UNIVERSAL_ROUTER,   // Who can spend it
    type(uint160).max,  // Amount limit
    expiration          // When this permission expires (unix timestamp)
);
```

### Step 3: Swap Execution

When the Universal Router executes a swap, it pulls tokens from the user via Permit2 — no further user interaction required.

## Checking Allowances

Query existing permissions:

```solidity theme={null}
(uint160 amount, uint48 expiration, uint48 nonce) = permit2.allowance(
    owner,           // User address
    tokenAddress,    // Token
    spender          // e.g., Universal Router
);
```

A swap will fail if:

* `amount` is less than the swap input
* `expiration` is in the past

## Security Benefits

* **Scoped permissions**: Each spender gets its own allowance with its own expiration
* **Single revocation point**: Revoking the ERC-20 approval to Permit2 disables all downstream spenders
* **Nonce tracking**: Prevents replay attacks
* **Expiration**: Permissions automatically become invalid after the set time