I used to think that contract authorization was no big deal, just leave it be after use and not bother with it; now I’ve really developed a habit of treating it like “turning off the stove/locking the door before bed.” Many protocols, during their cold start, default to allowing unlimited authorization to save a step and reduce friction, which is basically for convenience, but the risk is also bundled along with it... The project team isn’t necessarily malicious, but contract upgrades, front-end hijacking, dependency library issues—nobody can say for sure.

Recently, Layer 2 is again arguing about TPS, fees, and ecosystem subsidies. I look at it and think: no matter how cheap and fast it is, if you authorize to the wrong place, it’s just one click to wipe everything out. My current approach is just two things: limit the amount if possible, revoke after use, and if I’m too lazy to revoke, at least clear it periodically. Anyway, just like turning off the lights when sleeping, asset permissions shouldn’t stay on all the time.