Revoke Risky Token Approvals: Protect Your Wallet

Every time you connect your wallet to a decentralized app (dApp) and sign a transaction, you may be granting that app permission to spend your tokens. These “token approvals” are essential for interacting with DeFi protocols, but they can become a serious security risk if a project turns malicious or gets hacked. This guide shows you how to review your existing approvals and revoke any that are risky, using block explorers and dedicated revoke tools, so you can lock down your wallet and prevent unauthorized transfers.

What You’ll Need

• Your wallet’s public address (the long string starting with 0x on Ethereum, or similar for other chains)
• Access to a block explorer for the network you use (e.g., Etherscan for Ethereum, BscScan for BNB Chain, Polygonscan for Polygon)
• A revoke tool like Revoke.cash or the approval checker built into some wallets (e.g., MetaMask’s “Approval” tab in the portfolio site)
• Your wallet’s private key or seed phrase to sign the revocation transaction (never share these with anyone)
• Some native gas tokens (ETH, BNB, MATIC) to pay for the revocation transaction fees

Step-by-Step

1. Identify your network. Determine which blockchain(s) you use most often. Approvals are chain-specific, so you’ll need to check each network separately. Common ones include Ethereum, BNB Chain, Polygon, Arbitrum, and Optimism.
2. Open a block explorer. Go to the explorer for your network (e.g., etherscan.io). In the search bar, paste your wallet address and press Enter. This will open your wallet’s public profile page.
3. Find the “Approvals” or “Token Approvals” section. On Etherscan, look for a tab called “Approvals” or “Token Approvals” on your wallet page. On other explorers, it might be labeled “Permissions” or “Allowances.” If you don’t see it, use a dedicated revoke tool directly (step 5).
4. Review the list of approved contracts. The explorer will show a list of smart contracts that have approval to spend your tokens. For each, you’ll see the token (e.g., USDC, DAI), the spender contract (often a dApp like Uniswap or Aave), and the approved amount. The amount is often shown as “Unlimited” or a very large number. Pay special attention to any contract you don’t recognize or haven’t used recently.
5. Use a revoke tool (optional but recommended). Open a dedicated service like Revoke.cash. It supports multiple networks. Connect your wallet (click “Connect Wallet” and choose your wallet provider). The tool will automatically scan for all your approvals on the selected network and display them in a clear list, with the same info as the explorer but often easier to read.
6. Select the risky approvals. In the revoke tool, identify the approvals you want to remove. Typically, you should revoke:
   • Approvals for contracts you no longer use.
   • Approvals for unknown or suspicious addresses.
   • Approvals with “Unlimited” spending limits for tokens you hold significant amounts of.
7. Initiate the revocation. Click the “Revoke” button next to the approval you want to remove. The tool will ask you to confirm the transaction in your wallet. Review the transaction details carefully—it should be a simple call to the token contract’s approve function with an amount of 0.
8. Confirm and pay the gas fee. In your wallet, confirm the transaction. You’ll need to pay a network gas fee (in ETH, BNB, etc.). The fee is required to process the on-chain transaction. If the network is congested, you may need to adjust the gas price to get it processed faster.
9. Wait for confirmation. Once the transaction is broadcast, wait for it to be mined and confirmed. This can take from a few seconds to a few minutes depending on network traffic. You can track its status in your wallet or on the block explorer.
10. Verify the revocation. After confirmation, go back to the revoke tool or the block explorer and refresh the list. The approval should now show an amount of 0, or be removed entirely. Repeat the process for each network you use.

Common Mistakes

• Revoking on the wrong network. Approvals are per-network. If you revoke on Ethereum, it doesn’t affect approvals on Polygon. Always check the network you’re connected to in your wallet and the tool.
• Revoking everything. If you revoke all approvals, you’ll have to re-approve every dApp you use, which costs gas and time. Only revoke what you don’t trust or no longer need.
• Ignoring the “Unlimited” flag. Many dApps request unlimited approval to save you from re-approving each time. While convenient, it’s riskier. Consider revoking and re-approving with a limited amount if the dApp allows it.
• Using a phishing revoke site. Always double-check the URL of the revoke tool. Scammers create fake sites that steal your private key when you connect. Use well-known tools like Revoke.cash, or access them through your wallet’s official portal.
• Forgetting about approvals on sidechains and L2s. If you’ve used bridges or L2s like Arbitrum or Optimism, check those networks too. They have their own approval lists.
• Not checking the spender address. Sometimes a dApp uses a proxy contract that changes. The approval might be to an old contract address that is no longer in use. Revoking that is safe but not urgent. Focus on active spenders.

Tips

• Set a reminder to check regularly. Make it a habit to review your approvals every few months, or after you stop using a particular dApp.
• Use a hardware wallet. Hardware wallets add an extra layer of security. Even if a malicious contract tries to drain your tokens, the transaction must be physically confirmed on the device.
• Prefer limited approvals. When a dApp asks for approval, if it offers a “custom” amount, set it to the maximum you intend to spend in that session, not an unlimited amount. This limits potential losses.
• Monitor your approvals with alerts. Some tools like Etherscan allow you to set alerts for when a new approval is made on your wallet. This can help you catch unauthorized approvals early.
• Revoke before you stop using a dApp. If you’ve finished using a DeFi protocol, revoke its approval immediately. Don’t wait until you remember later.
• Keep a list of your active dApps. Maintain a personal list of the dApps you use and their contract addresses. This makes it easier to spot unknown approvals during review.

Troubleshooting

• Transaction is stuck or pending. This is usually due to low gas fees. In your wallet, you can try to speed up the transaction by paying a higher gas fee, or cancel it and resubmit with a higher fee. If it’s stuck for hours, it may eventually be dropped and you can try again.
• Revoke tool shows no approvals. Make sure you have selected the correct network in the tool. Also, if you’re using a fresh wallet, it may genuinely have no approvals. If you know you’ve used dApps, try a different revoke tool or check the block explorer directly.
• Revoking fails with an error. This can happen if the token contract is non-standard (e.g., some tokens have special approve functions). Try using a different revoke tool or manually call the approve function via the block explorer’s “Write Contract” section (advanced, requires careful use).
• You see an approval to an address you don’t recognize. Do not panic. It could be a legitimate contract from a dApp you used long ago. Before revoking, search the address on the block explorer to see if it’s a known contract (it will have a name like “Uniswap V2 Router”). If it’s a contract with no name and no transactions, revoke it immediately.
• Gas fees are too high. If the network is congested, revocation may be expensive. You can wait for a less busy time (e.g., weekends for Ethereum) or use a network with lower fees if your tokens are on a cheaper chain.
• You accidentally revoked an approval you still need. No problem. Simply go to the dApp you want to use again and approve the token as you normally would. You’ll pay a small gas fee for the new approval.

Frequently Asked Questions

What exactly is a token approval?

A token approval is a transaction you sign that tells a smart contract (like a DEX router) it can spend a certain amount of your tokens on your behalf. This is necessary for the contract to execute trades or other actions.

Why are unlimited approvals dangerous?

If a contract with unlimited approval is compromised or turns malicious, the attacker can drain all the tokens you’ve approved for that contract. Even if you don’t have unlimited approval, the approved amount is at risk.

How do I know if an approval is risky?

Check the spender address. If it’s a well-known protocol (like Uniswap, Aave, etc.), it’s likely safe. If it’s an unknown address or a contract with no name and no transactions, it’s risky. Also, if you don’t remember using the dApp, revoke it.

Do revoking approvals cost money?

Yes, each revocation is a transaction that requires a network gas fee. The fee varies depending on network congestion and the token’s contract complexity. On Ethereum, it can be a few dollars; on cheaper chains like Polygon, it’s often less than a cent.

Can I revoke approvals without using a third-party tool?

Yes. You can use the block explorer’s “Write Contract” feature to call the approve function on the token contract, setting the spender address and amount to 0. This is more technical and requires you to know the exact contract addresses.

Do approvals expire?

No, token approvals do not expire automatically. They remain active until you revoke them or the token contract is upgraded. That’s why regular review is important.

Related

• Nike Run Club: What It Does and How to Use It
• Robotaxi Recorded You? Your Rights & Next Steps
• Recover Deleted Photos from Memory Card: Full Guide