Session-Only Approval Enforcer

WHAT IT DOES

Session-Only Approval Enforcer is a powerful security tool that ensures all wallet approvals are limited to a configurable session duration, automatically revoking permissions when the session expires. When you visit any webpage that requests wallet approvals, the tool detects the approval request and intercepts the flow, displaying a panel that shows the proposed approval with a session timer. You must select an expiry time—options include 1 hour, 4 hours, 8 hours, 24 hours, or a custom duration—before the approval can proceed. The tool then sets the approval with a tracked session expiry or, where contract support exists, uses permit-style approvals with embedded deadlines. Once approved, the panel displays a live countdown timer showing the remaining session time for each active approval. When a session expires, the tool automatically revokes the approval using approve(0) for ERC-20 tokens or setApprovalForAll(false) for NFTs, and sends a notification. This eliminates the security risk of unlimited or long-lived approvals that can be exploited by malicious contracts.

WHERE IT RUNS

This overlay operates on any website (matching all URLs) across the entire web. It works in any browser that supports the BotGentz extension framework and has an EVM-compatible wallet extension installed. The panel activates on every page, scanning for approval requests and enforcing session limits on all detected approvals.

HOW TO USE

Install the extension and connect your wallet. The tool automatically activates on every page, scanning for approval-related content. When an approval request is detected, the panel displays the contract details and a session duration selector. Choose your preferred expiry time from the dropdown or enter a custom duration, then click "Approve with Session Limit." Your wallet will prompt you to confirm the approval transaction—once confirmed, the tool records the session and begins the countdown timer. The panel shows all active sessions with remaining time, contract addresses, and domains. Configure your settings: set a default session duration, enable or disable auto-revoke on expiry, toggle notifications, and manage an exclusion list for contracts you trust and want to exempt from session enforcement. When a session expires, the tool automatically sends a revoke transaction and notifies you.

MECHANISM: SESSION-BASED APPROVAL TRACKING WITH AUTO-REVOCATION

The extension implements a comprehensive session management system that enforces time-limited approvals across all token standards. When a user approves an approval request, the tool records the session in local storage with the contract address, spender address, expiry timestamp, and domain. For contracts that support ERC-2612 permits or EIP-712 signed approvals with deadlines, the tool can embed the expiry directly into the approval signature. For standard approvals without deadline support, the tool uses a combination of the recorded session timer and auto-revoke functionality: the timer counts down in real-time using the panel's update interval, and when the session expires, the tool automatically constructs and sends a revocation transaction. The revocation uses the appropriate contract function: approve(spender, 0) for ERC-20 tokens or setApprovalForAll(spender, false) for ERC-721/ERC-1155 NFTs. The tool also monitors for page changes, cleaning expired sessions on each navigation and refreshing the display of active sessions. The auto-revoke feature can be toggled on or off, with notifications sent via GM_notification on both approval creation and expiration. The exclusion list allows users to exempt trusted contracts (e.g., frequently used DEXs or marketplaces) from session enforcement, reducing unnecessary revocation transactions for services they trust.

THE PANEL

The overlay panel is fully draggable via its title bar and remembers its position per-site using GM_setValue. It snaps to the nearest edge when dragged within 40px of any screen boundary. The panel includes clear sections for session monitor (domain, wallet address, detected contracts, approval keywords), active sessions (list of all active session approvals with remaining countdown timers, contract addresses, and domains), approval request detection (when an approval is detected, shows contract details with session duration selector and custom input), settings (default session duration selector, auto-revoke toggle, notification toggle), exclusion list management (list of excluded contracts with remove buttons), and action buttons (Refresh, Revoke All Sessions, Copy Session Report, Clear Exclusions). The active sessions section updates in real-time, showing the countdown timer for each session. Pressing Escape temporarily dismisses the panel until you navigate to a new page or manually reactivate.

PLEASE NOTE

This extension requires the free BotGentz framework extension to be installed and active. You must also have a real EVM-compatible wallet extension (such as MetaMask, WalletConnect, Coinbase Wallet, or Rabby) already installed in your browser—the overlay uses your wallet's RPC provider for eth_call queries, to send approval and revocation transactions, and to detect approval requests. This tool sends on-chain transactions for both approvals and revocations—each transaction costs gas (approximately 20,000-45,000 gas). The tool cannot enforce session limits on contracts that do not support deadline parameters in their approve function; cannot automatically revoke approvals if the user is offline or the wallet is disconnected; depends on the page being open and the extension running to track session timers (though revocation attempts are retried on page load); cannot detect approvals that were granted before the tool was installed; does not support non-EVM chains where approval standards differ; cannot prevent approvals if the user manually confirms in their wallet regardless of warnings; and cannot enforce session limits for approvals granted via proxy contracts or multi-hop transactions. No private keys, wallet balances, browsing history, or approval data are ever collected, transmitted, or stored outside your local browser—all data is stored locally using GM_setValue. Use the exclusion list for contracts you trust and interact with frequently to avoid unnecessary gas costs from auto-revocation.