Token approvals and how to revoke them

When you use a decentralised exchange, lending protocol or NFT marketplace, you are usually asked to "approve" a token first. That approval gives a smart contract permission to move your tokens, and it often stays in place long after you have forgotten about it.

How approvals work

On Ethereum and other EVM chains, most tokens follow the ERC-20 standard. A contract cannot take your tokens unless you call approve(spender, amount) on the token first. After that, the approved spender can transfer up to amount of that token from your wallet at any time, without asking again.

• Unlimited approvals. Many apps request the maximum possible amount, so you do not have to approve again next time. Convenient, but it means the contract can move your entire balance of that token, including tokens you receive later.
• NFT approvals. For NFTs, setApprovalForAll(operator, true) lets the operator move every NFT you own in that collection.
• Approvals survive. They do not expire by default. An approval from two years ago is still active today.

Why this matters

• If a protocol you approved is later exploited, the attacker may be able to use the approval to drain your tokens.
• If you approved a malicious contract on a fake site, it can take the tokens whenever it chooses, sometimes days later.
• Drainer sites ask for approvals rather than transfers because an approval looks harmless in the wallet popup.

How to check and revoke

Approval checkers read the blockchain and list every active allowance for your address. Well-known ones include Revoke.cash and the token approval checkers built into block explorers such as Etherscan. Type their address yourself rather than following a link.

1. Enter your address (or connect your wallet) on the checker.
2. Look for unlimited allowances, approvals to contracts you do not recognise, and approvals to protocols you no longer use.
3. Revoking means sending a transaction that sets the allowance to zero. It costs a small amount of gas on each chain.
4. Repeat on every chain you use. Approvals are per chain.

Good habits

• When an app lets you, set a custom approval amount equal to what you are using now, instead of unlimited.
• Review approvals regularly, for example once a month, and after any airdrop season of heavy farming.
• Keep your vault wallet free of approvals. See wallet separation.

Off-chain permits are different

Some tokens support permit signatures (EIP-2612), and many apps use the Permit2 contract. These let you grant an allowance by signing a message instead of sending a transaction. Drainers love them because a signature costs no gas and looks less scary. A permit that has not yet been used does not show up as a normal approval, so revoking tools may not see it. See signature drainers.

Warning: Revoking approvals does not bring back tokens that have already been taken, and it does not help if your seed phrase or private key has leaked. In that case, move everything to a new wallet. See I've been hacked.