Token Approvals: How to List and Revoke Them

When you connect a wallet to a decentralized application (dApp) and approve a token for trading, lending, or staking, you are not just authorizing a one-time transaction. You are creating a standing permission that allows that dApp’s smart contract to move a specified amount of that token from your wallet at any time in the future. This permission is called a token approval, and it remains active until you revoke it or the token is entirely spent. Many users are unaware that these approvals persist indefinitely, and that they can be a vector for loss if the dApp is compromised or malicious.

This guide explains what token approvals are, why unlimited approvals became the norm, how to see what you have approved, and how to revoke them. It also covers common misconceptions and what to do if you suspect an approval has been exploited.

What Is a Token Approval?

In Ethereum and other EVM-compatible blockchains, tokens like ERC-20 are not held by your wallet directly; they are held by the token contract, and your address is associated with a balance. To transfer tokens on your behalf, a smart contract must be granted permission by you. This is done through the approve function, which allows a spender (the dApp’s contract) to withdraw a certain amount of your tokens, up to a limit you set.

When you initiate a transaction that requires the dApp to move your tokens—for example, when you swap tokens on a decentralized exchange (DEX) or deposit into a lending protocol—the dApp typically asks you to approve the token first. If you have not approved it before, you will see a signature request that says something like “Approve [Token] for [dApp]”. This signature is not the transaction itself; it is the authorization for the dApp to later move your tokens.

The approval is stored on the blockchain, not in your wallet. It is a record that says: “The address [dApp contract] is allowed to spend up to [amount] of [token] from the address [your wallet].” Once set, this permission remains until you revoke it, or until the allowed amount is reduced to zero (which happens automatically when the spender uses the allowance, but only for that specific amount).

The Rise of Unlimited Approvals

In the early days of DeFi, users had to approve each transaction individually, which was tedious and costly in gas fees. To improve user experience, dApps started requesting the maximum possible allowance—often the maximum value of the token (e.g., 2^256-1 for Ethereum-based tokens). This is known as an unlimited approval. It means the dApp can spend any amount of that token from your wallet, up to your entire balance, whenever it wants.

Unlimited approvals became the default because they reduce friction: you approve once, and then you can trade multiple times without re-approving. However, this convenience comes with a significant risk. If the dApp’s smart contract has a vulnerability, or if the dApp turns malicious (or is a scam from the start), the attacker can drain all the tokens you have approved for that contract. Even if you never use the dApp again, the permission remains, and a compromised contract can exploit it at any time.

The Risks of Leaving Approvals Active

Leaving token approvals active is like giving someone a blank check and never canceling it. The risk is not hypothetical; there have been numerous exploits where attackers took advantage of existing approvals. For example, in a phishing attack, a user might be tricked into signing a malicious approval transaction that grants a scammer access to their tokens. Or a legitimate dApp might be hacked, and the attacker gains control of the contract, allowing them to call the transferFrom function and move tokens from any wallet that has approved it.

Even without a hack, approvals can be used in other ways. Some tokens have a fee-on-transfer mechanism, and an approval might be used to move tokens in a way that triggers unexpected fees. Also, if you have approved a token for a contract that later becomes compromised, you could lose tokens even if you never interact with that contract again.

How to List Your Token Approvals

To revoke an approval, you first need to know what approvals you have. There are several ways to view them:

Using a Block Explorer

Most block explorers, such as Etherscan, allow you to view your token approvals. On Etherscan, go to your address page, click on the “More” dropdown, and select “Token Approvals”. This will show a list of contracts that have been approved to spend your tokens, along with the approved amount. However, this view may not show all approvals, and it can be slow for addresses with many transactions.

Using a Token Approval Checker

There are dedicated tools that aggregate approval data from the blockchain and present it in a user-friendly interface. These tools often allow you to connect your wallet and see all your approvals in one place. Examples include Etherscan’s Token Approval Checker, Revoke.cash, and others. These tools are read-only; they do not send any transactions unless you choose to revoke an approval, which will require a separate transaction.

Using Wallet Features

Some wallets, like MetaMask, have built-in approval management. In MetaMask, you can go to the “Activity” tab and see past approvals, but this only shows what you have done in that wallet, not all approvals on the blockchain. For a complete list, you need an external tool.

How to Revoke a Token Approval

Revoking an approval is a simple transaction that sets the allowance for a specific token and spender to zero. You can do this through a block explorer, an approval checker, or by using a wallet that supports it. The process is essentially the same: you call the approve function with a zero amount for the spender you want to revoke.

Here is how to revoke an approval using a block explorer like Etherscan:

1. Go to the token contract address on Etherscan.
2. Click on the “Contract” tab, then “Write Contract”.
3. Connect your wallet.
4. Find the approve function.
5. Enter the spender address (the dApp contract you want to revoke) and set the amount to 0.
6. Click “Write” and confirm the transaction in your wallet.

Alternatively, using a dedicated tool like Revoke.cash simplifies this: you connect your wallet, see a list of approvals, and click “Revoke” next to the one you want to cancel. The tool will prepare a transaction that sets the allowance to zero, and you confirm it in your wallet.

Important: Revoking an approval requires a transaction and incurs gas fees. There is no way to revoke without paying a fee, so it is wise to batch revocations to save on costs.

What People Get Wrong About Token Approvals

The most common misunderstanding is that token approvals are only relevant while you are actively using a dApp. Many users believe that once they leave a site or stop using it, the permission disappears. In reality, approvals are permanent on the blockchain until revoked. This misconception is natural because in traditional web services, logging out or closing the tab ends your session. But blockchain transactions are irreversible and permanent, and so are the permissions you grant.

Another mistake is assuming that unlimited approvals are only dangerous if the dApp is malicious. In fact, even a legitimate dApp can be exploited, and the approval remains valid. Also, some users think that if they have not used a dApp in a long time, the approval is no longer active, but that is false. The approval is stored on the blockchain and can be used at any time.

A third error is confusing token approvals with transaction signatures. When you sign a transaction to swap tokens, you are authorizing a one-time transfer. But the approval is a separate, standing permission. Users often see the approval signature and think it is the transaction itself, not realizing it is a separate authorization that persists.

How to Protect Yourself

• Revoke approvals you no longer need. Periodically review your approvals and revoke those for dApps you no longer use. This reduces the attack surface.
• Use limited approvals when possible. Some dApps allow you to set a custom approval amount. If you only need to trade a small amount, approve only that amount, not the maximum. However, this is not always possible, and some dApps require unlimited approvals for their functionality.
• Be cautious with signature requests. Always verify that the contract address in the approval request matches the dApp you intend to use. Scammers can create fake dApps that request approval to a malicious contract.
• Never share your private key or seed phrase. No legitimate service will ever ask for your private key or seed phrase. If a site asks for them, it is a scam.
• Use a hardware wallet. Hardware wallets add a layer of security because the private key never leaves the device, and you can review the transaction details on the device screen before signing.

What to Do If You Think You’ve Been Compromised

If you suspect that an approval has been exploited, or you have signed a malicious approval, act quickly:

1. Transfer your funds to a new wallet. The fastest way to protect your assets is to move them to a wallet that has not approved any malicious contracts. This can be done by sending your tokens to a new address you control.
2. Revoke the approval. If you still have access to the wallet and the funds, revoke the approval to prevent further loss. But if the attacker is already draining your funds, revoking may not help if they have already moved the tokens.
3. Report the incident. If you have lost funds, you can report the incident to the dApp’s team, the token issuer, or law enforcement, though recovery is unlikely.

Comparison of Approval Management Tools

Managing token approval risk

Token approvals are a fundamental part of interacting with DeFi, but they carry risks that many users overlook. By understanding what they are, why unlimited approvals are common, and how to revoke them, you can take control of your wallet’s security. Regularly review your approvals and revoke those you no longer need. This simple practice can prevent significant losses if a dApp is compromised or turns malicious.