How to Revoke Token Approvals to Protect Your Wallet

Every time you interact with a DeFi protocol, you grant it permission to spend tokens from your wallet through a mechanism called token approvals. Many dApps request unlimited approval by default, meaning the smart contract can drain your entire balance of that token at any time — even months after you last used the protocol. Revoking stale and unlimited approvals is one of the simplest security measures you can take, and tools like Revoke.cash make the process straightforward.

What Are Token Approvals and Why Are They Dangerous?

Token approvals are permissions you grant to smart contracts allowing them to move ERC-20 tokens from your wallet. When you swap tokens on Uniswap or deposit into an Aave lending pool, you first sign an approval transaction giving that contract access to your tokens. Without this approval, the contract cannot touch your balance.

The danger comes from unlimited approvals. Most DeFi interfaces request approval for the maximum possible amount (2^256 – 1 tokens) rather than the exact amount you intend to use. This saves gas on future transactions since you only approve once. But it means the contract — and anyone who exploits a vulnerability in that contract — has permission to transfer your entire balance.

According to blockchain security firm SlowMist, approval exploits accounted for over $200 million in losses across DeFi in recent years. The attack pattern is consistent: hackers find a vulnerability in a smart contract that already has unlimited approval from thousands of wallets, then drain those wallets in automated batches. The victims approved the contract months earlier and forgot about it. For broader wallet security practices, see our wallet security best practices guide.

How Do You Check Your Current Token Approvals?

Several free tools audit your wallet’s outstanding approvals across multiple chains. The two most reliable options are Revoke.cash and Etherscan’s token approval checker.

Revoke.cash is an open-source tool that scans your wallet across Ethereum, Polygon, Arbitrum, Optimism, BSC, Avalanche, and dozens of other EVM chains. Connect your wallet, select a network, and the tool displays every active approval with the contract address, the token, and the approved amount. It flags unlimited approvals in red.

Etherscan Token Approval Checker (etherscan.io/tokenapprovalchecker) works for Ethereum mainnet. Enter your wallet address and it lists all ERC-20, ERC-721, and ERC-1155 approvals. Similar tools exist on Polygonscan, Arbiscan, and other block explorers for their respective chains.

Review your approvals monthly. Protocols you used once six months ago still have access to your tokens unless you explicitly revoked their permission.

How Do You Revoke a Token Approval Step by Step?

Revoking an approval is an on-chain transaction that sets the approved amount back to zero. It costs gas — typically $1-5 on Ethereum mainnet, and fractions of a cent on L2s like Arbitrum or Base.

Using Revoke.cash:

1. Go to revoke.cash and connect your wallet (MetaMask, WalletConnect, or any injected wallet).
2. Select the network you want to audit from the dropdown.
3. Wait for the scan to complete. All active approvals appear in a list.
4. Click “Revoke” next to any approval you want to remove.
5. Confirm the transaction in your wallet. Each revocation is a separate transaction.
6. Repeat for each network where you have active approvals.

Using Etherscan:

1. Navigate to etherscan.io/tokenapprovalchecker.
2. Enter your wallet address and click search.
3. Connect your wallet using the “Connect to Web3” button.
4. Click “Revoke” next to any approval you want to remove.
5. Confirm the transaction in your wallet.

Prioritize revoking approvals for protocols you no longer use, contracts you do not recognize, and any unlimited approvals on high-value tokens. Keeping your seed phrase stored securely remains your first line of defense, but revoking approvals closes a common secondary attack vector.

Should You Use Limited Approvals Instead of Unlimited?

Yes. Setting exact-amount approvals limits your exposure if a contract is exploited. Instead of approving the maximum, approve only the amount you plan to use in the current transaction.

MetaMask allows you to edit the approval amount during the transaction confirmation step. When a dApp requests unlimited approval, click “Edit Permission” (or “Custom Spend Limit” depending on version), enter the exact amount you intend to swap or deposit, and confirm. This means you will need to approve again for future transactions, but the gas cost is negligible on most networks.

Some DeFi protocols now default to exact-amount approvals. Uniswap v3’s interface, for example, requests approval for only the amount being swapped. The Permit2 standard, also developed by Uniswap, adds time-limited approvals that expire automatically. According to Uniswap’s documentation, Permit2 reduces the risk of stale unlimited approvals by requiring periodic re-authorization.

My recommendation: always use exact-amount approvals on Ethereum mainnet where gas costs make frequent approvals noticeable. On L2s where gas is nearly free, approving exact amounts on every transaction adds minimal cost and meaningfully reduces risk.

What Happens if a Contract You Approved Gets Hacked?

If a smart contract with your approval is exploited, the attacker can use the contract’s existing permissions to transfer your approved tokens. This happens without any action from you — no phishing email, no fake website, no social engineering. The approval you signed weeks or months ago is the attack vector.

The Badger DAO exploit in December 2021 demonstrated this clearly. According to Rekt News, attackers compromised Badger’s frontend and injected malicious approval requests. Users who signed those approvals had their funds drained days later when the attacker executed the transfers. Total losses exceeded $120 million.

Understanding what happens if an exchange goes bankrupt is another dimension of counterparty risk. But unlike exchange custody, approval risk is entirely within your control to mitigate. Read our full research methodology for how we verify security claims.

Frequently Asked Questions

Does revoking a token approval affect my existing deposits?

No. Revoking an approval only removes the contract’s permission to move tokens from your wallet in future transactions. Tokens already deposited into a protocol (in a liquidity pool, lending market, or staking contract) remain there. You would need to withdraw them separately.

How much does it cost to revoke an approval?

Revoking costs gas for one on-chain transaction. On Ethereum mainnet, this typically costs $1-5 depending on network congestion. On Layer 2 networks like Arbitrum, Optimism, or Base, the cost is usually under $0.10. Each approval requires a separate revocation transaction.

Can NFT approvals be exploited the same way?

Yes. ERC-721 (NFT) and ERC-1155 (multi-token) approvals work similarly to ERC-20 approvals. Granting “setApprovalForAll” to a contract gives it permission to transfer any NFT from that collection in your wallet. Revoke stale NFT marketplace approvals the same way you revoke token approvals.

How often should I audit my token approvals?

Monthly is a reasonable cadence for active DeFi users. Audit immediately after using a new protocol for the first time, and after any reported exploit on a protocol you have interacted with. Tools like Rabby Wallet surface approval alerts automatically.

This article is for informational purposes only and does not constitute financial or security advice. Cryptocurrency involves significant risk. Consult a qualified professional before making decisions about digital asset security.

Sources

• Revoke.cash — Open-source token approval management tool (checked August 2026)
• Etherscan Token Approval Checker — Ethereum approval auditing (checked August 2026)
• Uniswap Permit2 Documentation — Time-limited approval standard (checked August 2026)
• SlowMist Security Reports — Blockchain security incident analysis (checked August 2026)
• Rekt News — Badger DAO Exploit — Approval exploitation case study (checked August 2026)