What Is a Token Approval and How to Revoke It Safely

Every time you interact with a decentralized app, swap tokens on Uniswap, or mint an NFT, you are likely signing a token approval transaction. This permission lets the smart contract spend a specific amount of your tokens. While approvals are necessary for DeFi to work, leftover or excessive approvals are one of the most common ways attackers drain wallets.

In 2024 alone, wallet drainers linked to fake airdrops and phishing sites stole hundreds of millions of dollars by abusing existing token approvals. Understanding how to check and revoke these approvals is a basic but effective safety step.

A token approval is an on-chain permission you grant to a smart contract address. When you approve the Uniswap router to spend your USDC, the contract can later call the transferFrom function to move your tokens on your behalf. The approval includes a spender address and an allowance (the amount the spender can take).

Approvals are stored in the token contract itself, not in your wallet. Even if you move tokens to a new wallet, the old approvals remain on the old address until revoked.

If a smart contract you approved is later compromised, or if you approved a malicious contract by mistake, the attacker can call transferFrom to drain your tokens up to the allowance limit. Common scenarios include:

• Fake airdrop sites that ask you to approve a malicious contract.
• Impersonated DEX interfaces that look identical to the real app.
• Forgotten approvals from abandoned DeFi protocols that later get exploited.

Approvals set to “unlimited” (uint256 max) are especially risky because they allow the spender to take your entire balance of that token, now and in the future.

You can check all approvals for an Ethereum address using block explorers or dedicated tools.

Source-tracked CryptoRescue article.

Click the “More” menu and select “Token Approvals.”
3. A page loads showing all ERC-20 approvals—spender address, token, allowance, and status.
4. You can also see the “Approved” label and a “Revoke” button for each approval.

Etherscan works for Ethereum mainnet only. For other chains, use the equivalent explorer.

Revoke.cash is a free, open-source tool that supports Ethereum, BSC, Polygon, Arbitrum, Optimism, Avalanche, and many other EVM chains.

The tool scans your address across multiple chains.
3. You see a list of all approvals with token name, spender, allowance, and a “Revoke” button.
4. Click “Revoke” to send a transaction that sets the allowance to zero.

Revoke.cash also shows the date of the approval and whether the spender is a known contract.

Revoking an approval is a transaction that sets the allowance to zero. It costs gas (ETH, BNB, MATIC, etc.) but is usually a cheap operation.

Connect your wallet.
3. Find the approval you want to remove.
4. Click “Revoke” and confirm the transaction in your wallet.
5. Wait for the transaction to confirm. The allowance is now zero.

After revoking, you can still use the same DEX or protocol later—you will simply need to approve again the next time you interact with it.

NFT approvals work similarly but use the ERC-721 or ERC-1155 standard. The same tools (Revoke.cash, Unrekt) can also check and revoke NFT approvals. The risk is the same: a malicious marketplace or phishing site can transfer your NFTs if you have given them approval.

• Never approve a contract you cannot verify. Check the spender address against the official project documentation.
• Use “limited” approvals instead of infinite. Most DEXs now allow you to set a custom limit or “revoke after use.”
• Set a recurring reminder (e.g., every 3 months) to review your approvals.
• If you use multiple wallets, check each one separately.
• After connecting to a new dApp, immediately check the approval you just created to confirm it is for the correct address and amount.

• Revoke.cash and block explorers rely on public RPC nodes. If a node is down, the data may be incomplete.
• Some approvals are hidden because they use a different token standard (e.g., ERC-777). These are rare but can bypass standard approval checkers.
• Revoking does not prevent future phishing. You must stay vigilant about where you connect your wallet.
• No tool is 100% comprehensive. Treat approval checkers as a helpful scan, not a guarantee of safety.

If you have not checked your token approvals in the last six months, connect your wallet to Revoke.cash and review the list. Remove any approvals for contracts you no longer use or that have unlimited allowances. This one action reduces your exposure to the most common wallet drainer attacks.