# ERC-20 approval decoder — Call Lens

Canonical: https://calls.agiscorecard.com/guide.html
Reviewed: 2026-09-19
Author: AGI Scorecard team
Version: 1.1.0

Call Lens decodes supported token-call shapes locally and compares the recipient, spender and atomic amount with your expectations. It distinguishes ERC-20 allowances from ERC-721 token IDs using the declared standard. It never connects a wallet or evaluates contract safety.

## Method

Decode only exact two-word transfer, approve and setApprovalForAll ABI shapes. Compare supplied recipient/spender and limit; identify broad approval and attached native value.

## Workflow

1. Copy a prepared call from a source you already control. Do not paste private keys or seed phrases.
2. Enter the expected destination and atomic-unit limit from your intended action.
3. Review differences and use your trusted wallet/simulator for the actual decision.

## Common mistake

A correctly decoded call can still target a malicious contract. No flags means only that the supplied checks found no mismatch, not that signing is safe.

## Worked scenarios

### Unlimited ERC-20 approval

Compare maximum uint256 allowance with an entered limit.
Fictional inputs: https://calls.agiscorecard.com/examples/unlimited.json
Run: https://calls.agiscorecard.com/?scenario=unlimited#workbench
- Declared method: approve(address,uint256)
- Policy flags: 2
- Security verdict: Not assessed

### A bounded approval

Use an explicit allowance while retaining the unassessed safety state.
Fictional inputs: https://calls.agiscorecard.com/examples/limited.json
Run: https://calls.agiscorecard.com/?scenario=limited#workbench
- Declared method: approve(address,uint256)
- Policy flags: 0
- Security verdict: Not assessed

### The same selector, an NFT

Interpret the integer as token ID 42 under declared ERC-721.
Fictional inputs: https://calls.agiscorecard.com/examples/nft.json
Run: https://calls.agiscorecard.com/?scenario=nft#workbench
- Declared method: approve(address,uint256)
- Policy flags: 0
- Security verdict: Not assessed

## Questions

### Why is approve(address,uint256) ambiguous?

ERC-20 and ERC-721 share that selector but use the integer differently: a fungible-token allowance versus a token ID. The declared standard is necessary context and must be verified against the actual contract.

### Is Call Lens free, and do I need a wallet?

All current functions are free beta. No account, wallet connection, subscription or model API key is needed. No chain simulation, malicious-contract detection, token identity lookup, balance inspection or safety verdict.

### Can I use my own records and keep them private?

Yes. Enter records, import JSON or paste CSV into record groups. Inputs and comparison snapshots stay in this browser tab. Share-example links contain only a public scenario name. Review downloaded reports before sharing your records.

## Alternatives and official sources

- [Blockaid](https://blockaid.io/): Onchain security, transaction protection, monitoring and threat intelligence.
- [Tenderly](https://docs.tenderly.co/simulations/overview): Transaction simulation with decoded traces, gas estimates and asset changes.
- [ERC-20 specification](https://eips.ethereum.org/EIPS/eip-20): Defines fungible-token transfers and allowances; implementation behavior still matters.

A real security product or simulator has chain context this decoder lacks. A known selector and an empty flag list cannot show that a contract is safe.

## Limits

No chain simulation, malicious-contract detection, token identity lookup, balance inspection or safety verdict.
A selector can collide and a contract can implement unexpected behavior. This is not transaction simulation, scam detection, contract auditing or permission to sign.

No token decimals, token symbol, ownership, current allowance or chain state are inferred. An absence of flags means only that these supplied policy checks found no mismatch.

This tool never connects a wallet, requests a signature, broadcasts a transaction or fetches the pasted contract.

## Input and output

Structural schema: https://calls.agiscorecard.com/input.schema.json
The engine additionally validates ranges, dates, amount formats, uniqueness and cross-field rules.
Input JSON and CSV paste are processed locally. No model, account or wallet is needed.
Reports can be downloaded as JSON or Markdown and printed locally. Public scenario links never include user records.

## Price and license

Current functions are free beta. No paid plan or update SLA is offered.
Tool bundle license: https://calls.agiscorecard.com/LICENSE.txt
Privacy: https://calls.agiscorecard.com/privacy.html