Token approvals and how to revoke them

What an approval is

On Ethereum and other EVM chains, a contract cannot take tokens out of your wallet on its own. To let a decentralised exchange swap your USDC, you first send an approve transaction to the USDC contract, naming the exchange’s contract as the spender and setting an amount. The token contract records that allowance. From then on the spender can move up to that amount from your wallet whenever it likes, without asking you again.

Every ERC-20 app works this way, and most approvals are harmless. The risk comes from how much you approve and to whom, and from approvals left in place long after you stopped using an app.

Why unlimited approvals are risky

Many apps ask for an unlimited allowance so you never have to approve again. On the chain it is the largest number the contract can store, 2^256 − 1, which our transaction lookup shows in full when it decodes an approve call. An unlimited approval to a contract that is later hacked, or that was malicious from the start, puts your entire balance of that token at risk for as long as the approval stands.

NFTs have an equivalent. setApprovalForAll gives an operator control of every NFT you hold in that collection, including any you acquire later.

Signatures that work like approvals

Not every approval is a transaction. Tokens that support permit (EIP-2612) let you grant an allowance by signing a message, which costs no gas and puts nothing on the chain until the spender uses it. Uniswap’s Permit2 contract, which many apps and wallets use, does the same for any token once you have approved Permit2 itself. A drainer site needs only one such signature: it submits the signature and takes your tokens in the same transaction.

Your wallet shows these requests as structured data (EIP-712). Read the fields. A spender you do not recognise, a large amount and a distant deadline are the marks of a permit, and a “sign in” or “claim” button that produces one is an attack.

Since Ethereum’s Pectra upgrade in May 2025 there is one more kind of permission: an EIP-7702 authorisation, which lets your account run a contract’s code. Wallets use it only for code they have vetted. A website asking you to sign an authorisation for your account is asking for control of everything in it.

Review your approvals

1. Find them. Wardcrest’s approvals checker lists the ones still in force for any address, many wallets list approvals in their settings, block explorers such as Etherscan have a token approval checker, and Revoke.cash covers most EVM chains. Type the site’s address yourself: phishing copies of approval tools are common.
2. For each approval, note the token, the spender and the amount. Unlimited amounts and spenders you do not recognise come first.
3. Identify the spender. Paste its address into the address checker for labels and scam flags, and into the contract admin inspector to see whether it can be upgraded and who controls it. A spender whose code one key can change is only as safe as that key.
4. Check every chain you use. Approvals on Base or Arbitrum are separate from those on Ethereum.

Revoke them safely

Revoking is a transaction from your own wallet that calls approve again with an amount of zero, or setApprovalForAll with false for NFTs. An approval tool builds it for you, but you sign it in your wallet, so check what the wallet shows before you confirm:

• The transaction goes to the token contract.
• The function is approve or setApprovalForAll, the spender is the one you mean to revoke, and the amount is 0 (or the flag is false).
• Nothing asks you to send tokens or ETH, or to sign a permit. A “revoke” that does either is a scam.

Each revoke costs gas, so on Ethereum it can make sense to start with unlimited approvals on tokens you actually hold. On layer 2s, revoking everything you no longer use is cheap. For Permit2, revoking the token’s approval to the Permit2 contract itself cuts off every Permit2 allowance for that token at once.

Habits that prevent it

• Use a separate hot wallet with small balances for new apps and mints, and keep savings in a wallet that never approves anything.
• Approve exact amounts whenever the app allows it.
• If you do not understand a signature request, do not sign it.
• Review your approvals every few months, and straight away when an app you have used is reported hacked.
• For a Safe, run pending transactions through the Safe transaction checker, which flags unlimited token approvals as critical before anyone signs.