Decode transaction input data: function, arguments and risky approvals

Calldata is the input of a transaction to a contract. Its first four bytes are the function selector, the first four bytes of the keccak-256 hash of the function's signature. The rest are the arguments, ABI-encoded: each static value takes a 32-byte word, and dynamic values (strings, bytes, arrays) are stored after an offset.

To decode it you need the function's signature: from the contract's ABI, or from a list of known functions. The selector alone only says which function was probably called, since different signatures can share four bytes.

approve(spender, amount) lets the spender move up to that amount of the token from your wallet; an amount of 2^256 − 1 is unlimited and never runs out. setApprovalForAll(operator, true) lets the operator move every NFT you hold in the collection. Drainers ask for exactly these, so decode before you sign.

• approve or increaseAllowance with the maximum value: unlimited allowance.
• permit signatures grant the same allowance without a transaction of your own.
• setApprovalForAll with true: access to the whole collection.