Token approvals: how to check and revoke them safely
A token approval lets a smart contract spend a token from your wallet, often in unlimited amounts. Old or malicious approvals let attackers drain tokens long after you used a site. Check your approvals every few months and revoke any you don't recognise or no longer need, using your wallet's approval manager or a trusted checker you reach by typing its address.
What is a token approval?
On Ethereum and other EVM chains, a decentralised exchange or app can't take your tokens unless you first approve its contract to spend them. Many apps ask for an unlimited approval so you don't have to approve again. That permission stays active until you revoke it, even if you never visit the site again.
The risk has been known for years. In March 2020 ZenGo showed that most dApp wallets granted unlimited ERC-20 allowances that a rogue or hacked app could later drain (Cointelegraph, Mar 2020).
Kinds of permission to look for
| Permission | What it allows | Where you see it |
|---|---|---|
approve / allowance | Spend up to an amount of one ERC-20 token | On-chain transaction |
setApprovalForAll | Move all your NFTs in one collection | On-chain transaction |
| Permit (EIP-2612) | Same as approve, granted by an off-chain signature | Signature request, no gas |
| Permit2 | Uniswap's shared approval system; you approve Permit2 once, then sign per-app permits | Approval plus signature requests |
| Solana token delegate | Lets another account move a set amount of a token | Transaction |
| Tron TRC-20 approval | Equivalent of an ERC-20 allowance on Tron | Transaction |
Why it matters: real cases
- Oct 2022: an exploit in the Rabby Swap router contract drained tokens users had approved; Rabby told Swap users to revoke all approvals (The Block, Oct 2022).
- Dec 2023: a suspected leaked admin key let attackers upgrade a deprecated OKX DEX contract and take about $2.7M of tokens users had approved; OKX revoked permissions and pledged reimbursement (The Block, Dec 2023).
- Feb 2024: Angel Drainer used Permit2 approvals with a malicious Safe vault contract to take about $403K (Cointelegraph, Feb 2024).
Even legitimate, once-safe contracts can become dangerous if they are later hacked. That is why old unlimited approvals are a liability.
How to check and revoke approvals safely
- Use a tool you reach yourself. Options include your wallet's built-in approval manager (Rabby has one), Revoke.cash, and the token approval checkers on block explorers such as Etherscan (and its sister explorers for other EVM chains). Type the address or use a bookmark: fake "revoke" sites are a known drainer lure.
- Connect read-only or paste your address to view approvals. Viewing is free.
- Look for unlimited amounts, spenders you don't recognise, apps you no longer use, and anything approved around the time of a suspicious signature.
- Revoke. Each revoke is a transaction that sets the allowance to zero and costs a small network fee. Check the wallet's preview: a genuine revoke sends no tokens.
- Repeat per network. Approvals are per chain, so check Ethereum, BNB Chain, Base, Arbitrum, Polygon and any other network you have used.
Signed Permits: an off-chain Permit signature is valid until it expires or is used. Revoking the token's allowance after it has been used stops further spending, and moving the tokens to a fresh wallet is the surest fix if you think a malicious Permit is outstanding.
Good habits
- When an app offers it, approve the exact amount for the trade instead of unlimited.
- Use a separate hot wallet for new or experimental apps.
- Review approvals every few months, and immediately after any suspicious signature.
- Never pay a site or person to "revoke for you", and never enter a seed phrase to revoke. Revoking only requires a normal transaction.
If you've already been drained, start with what to do after a drainer.
Frequently asked questions
Does revoking an approval cost money?
Yes, a small network fee, because revoking is an on-chain transaction. Viewing your approvals is free.
Will revoking an approval get my tokens back?
No. It only stops future spending. Tokens already moved cannot be recovered by revoking.
Is Revoke.cash safe?
It is a widely used approval tool, but always type the address yourself, because fake revoke sites exist. Check that every transaction you sign is a revoke that sets an allowance to zero and sends no tokens.
Do I need to revoke approvals for Uniswap or other big apps?
Approvals to well-known contracts are lower risk, but not zero. Revoking those you don't use reduces exposure if a contract is ever exploited.
Does Bitcoin have token approvals?
No. Bitcoin has no approval mechanism like ERC-20. Approvals are a feature of smart-contract chains such as Ethereum, EVM networks, Solana and Tron.