Why allow unlimited to edit allowance?

[TragedyHasStruck]

I've recently discovered this project and it is great for listing allowances, but when I thought I'd check out the edit allowance feature the first transaction that I get in my Metamask is a transaction to allow your very site to spend an unlimited amount of that particular token. This is exactly what I'm trying to avoid.

Is it not possible to do this simply through the contract that has received the allowance? Why is this step necessary, and what is the next step (which I don't dare to do because I find this step rather frightening)?

Also, very specifically, what function in which contract is called to do the actual zeroing of a particular allowance?

This is the first transaction I'm asked to accept:

Allow Https://tac.dappstar.io to spend your <TOKEN>?
Do you trust this site? By granting this permission, you’re allowing Https://tac.dappstar.io to withdraw your <TOKEN> and automate transactions for you.

As I'm writing this I realize that you might actually only be requesting a 0 spending limit, but Metamask appears to be suggesting "Unlimited". The details of the permission is as follows:

Spend limit permission
Allow Https://tac.dappstar.io to withdraw and spend up to the following amount:

• Unlimited
  Spend limit requested by Https://tac.dappstar.io
  0 <TOKEN>

Any clarification on understanding this would greatly help in trusting this project. It might also be useful in a documentation.

[TripleSpeeder]

Hey, thank you for your feedback! The message you are seeing is actually quite misleading. What happens is the following:

1. TAC calls "approve" on the ERC20 token contract to change the approved amount for an existing spender address.
2. Metamask detects the "approve" call in the transaction and displays it's standard warning message, which is really useful for the normal usecase, but really confusing for the TAC usecase :-/

So in reality there is no approval done for TAC. Rather you are changing the approval for some other site. The problem is that Metamask can not know who is the owner of the spender address that TAC is changing the approval for, so they assume that the spender address belongs to the current website.

This question keeps coming up recently, so i raised an issue with Metamask to see if there is a way to improve the message, as it is really confusing. You can follow the issue at MetaMask/metamask-extension#9721.

I will also add a clarification to TAC why you see this warning. I fully agree with you that it sounds frightening.

[tennox]

More specific MetaMask issue:
MetaMask/metamask-extension#11125