How to check and revoke token approvals

Every swap, NFT listing or bridge you've used left a permission behind. That permission, a token approval, lets a smart contract move a specific token out of your wallet without asking you again. Most are harmless. But approvals don't expire, and when a contract you approved years ago is exploited, or a site you signed on turns out to be a drainer, the approval is how the money leaves.

This guide explains what approvals are, how to find yours, which to revoke first, and how to keep the list short.

What a token approval is

ERC-20 tokens (USDC, WETH, most of what you hold on Ethereum, Base, Arbitrum or BNB Chain) can't be pulled by a contract unless you've called approve(spender, amount) on the token first. A DEX router needs that before it can take your USDC and give you ETH back.

There are three kinds to know:

• ERC-20 approvals: approve(spender, amount). Many dApps ask for the maximum possible amount (2²⁵⁶−1), shown in wallets as "unlimited", so you don't pay gas to approve again next time.
• NFT approvals: setApprovalForAll(operator, true) lets a marketplace or contract move every NFT you hold in that collection, now and in the future.
• Off-chain permits: EIP-2612 permit and Uniswap's Permit2 let you approve with a gas-free signature. You often grant Permit2 itself one unlimited approval per token, and individual apps then get time-limited sub-allowances through signatures.

Why old approvals are a risk

• Contract exploits. If a protocol you approved is hacked, attackers can sometimes use existing approvals to drain users who never interacted with it again. Several large DeFi incidents worked exactly like this.
• Phishing signatures. Drainer sites ask for an approval or a permit that looks routine. Once signed, they move tokens whenever they like, sometimes days later when you deposit more.
• Unlimited by default. An unlimited approval to a contract you used once for $50 also covers the $5,000 of the same token you hold today.

How to check your approvals

1. Open the token approval checker, pick the chain and paste your public wallet address. Nothing is signed and nothing is connected.
2. You'll see every active approval, re-checked on-chain right now: the token, the spender contract (with its name if it's known), the allowance and a risk level.
3. Repeat for each chain you've used. Approvals are per chain, so an approval on Base doesn't show on Arbitrum.

Block explorers have their own approval pages too (Etherscan's "Token Approval Checker", for example), which are a useful second opinion.

Which approvals to revoke first

Work through the list in this order:

1. Flagged spenders. Anything marked high risk or flagged as malicious or phishing. Revoke immediately, and treat the wallet as exposed (see below).
2. Unlimited approvals to contracts you don't recognise. If you can't say what the contract is, you don't need it to have unlimited access.
3. Unlimited approvals to apps you no longer use. That old yield farm, a bridge you used once, an NFT marketplace you've left.
4. NFT ApprovalForAll to marketplaces you don't list on any more.

You can keep approvals to the router of a DEX you use every week; revoking it just means you pay a small approval fee next time. That's a trade-off between convenience and exposure, and for large balances exposure usually wins.

How to revoke, and what it costs

Revoking is a normal transaction from the wallet that gave the approval:

• For ERC-20s it calls approve(spender, 0).
• For NFTs it calls setApprovalForAll(operator, false).

On the checker, the Revoke button asks your browser wallet (MetaMask, Rabby, Coinbase Wallet) to send exactly that transaction. Your wallet shows the call before you sign. Nothing else is requested, and no site needs your seed phrase to revoke anything.

A revoke uses about 46,000 gas. On Base, Arbitrum or Optimism that's usually well under a cent. On Ethereum mainnet it depends on the gas price; check the gas tracker and revoke when it's quiet if nothing urgent is flagged.

If a drainer already has an approval

If a flagged spender holds an approval on a token you still own, move fast:

1. Revoke the approval for every affected token and chain.
2. If you also signed an off-chain permit or a message you didn't understand, assume the wallet is compromised. Create a fresh wallet with a new seed phrase and move the remaining assets there. Revoking doesn't cancel a permit signature that's already been used.
3. Never pay "recovery" services that DM you. They're a second scam aimed at victims.

Read how wallet drainers work for the full playbook.

Keep the list short

• Approve exact amounts when your wallet offers it. Rabby and MetaMask both let you edit the amount before signing.
• Use separate wallets: a hot wallet for mints and new dApps, and a long-term wallet that rarely signs anything.
• Check approvals monthly, and after any airdrop season or NFT mint spree.
• Read every signature request. If a "sign in" prompt mentions permit, approve or a spender address, it isn't a sign-in.