I was just cleaning up my desktop and found an old alarm clock, and it suddenly made me think: revoking authorization is like setting an alarm / going to sleep—don’t think, “If I’m not sleepy today, then I won’t sleep.” A lot of people, the moment they go on-chain, just grant the contract an infinite allowance with a tap—plainly speaking, you’re treating your wallet like its cash machine. The contract might get upgraded someday, the permission flags might be set wrong, the admin key might run into trouble, or the front end might get tampered with through a compromised/malicious link—while you’re still here, scrolling through discussions about the rate-cut expectations, the U.S. dollar index, and risk assets going haywire together, they’ve already moved your balance away in the background……

My own habit is: revoke after using it. If I truly use it often, I only give it the amount of allowance that’s actually needed. When I see those strange owner/upgrade permissions, I’ll take a closer look; if I’m not sure, I treat it as dangerous for now. After all, as long as that authorization loophole isn’t closed, even if you sleep as sweetly as can be, it still won’t feel solid or reassuring.