Revoke Token Approvals: How To Check And Cancel Them Safely

To revoke a token approval, paste your public wallet address into an approval checker such as Etherscan’s Token Approvals page or Revoke.cash, find the permission you no longer need, and sign a new transaction that sets its allowance to zero. Checking is free; revoking costs a small network fee, and it matters because approvals never expire on their own.

If you’ve used decentralized finance (DeFi) apps on Ethereum or similar networks, you have probably signed approvals without thinking much about them. Many of those permissions are still active. This guide explains what an approval is, why so many are unlimited, how to find yours, and how to cancel them without making things worse.

What is a token approval?

A token approval is a permission slip that lets a smart contract move one of your tokens on your behalf. On Ethereum, the ERC-20 token standard (EIP-20) includes a function called approve, which “allows _spender to withdraw from your account multiple times, up to the _value amount.” The amount you allow is called the allowance.

The contract later uses a second function, transferFrom, which the standard describes as “allowing contracts to transfer tokens on your behalf.” Revoke.cash puts it plainly: “Token approvals are used to give permission to a smart contract to spend your tokens on your behalf.”

You sign approvals when you swap on a decentralized exchange, lend, bridge, or list an NFT for sale. NFT approvals can be wider still. Revoke.cash says unlimited NFT approvals let a contract transfer “any NFT within a collection.”

Why are some token approvals unlimited?

Apps often ask for unlimited approvals so you only approve once. Ethereum.org says projects do this “to minimize the number of requests required,” meaning the user approves once and pays the transaction fee once.

The trade-off is that the door stays open wider than the job needed. Ethereum.org warns that with unlimited access, “they can spend all those tokens even if you have withdrawn your funds from their platform into your wallet.” Taking your money out of an app doesn’t take the permission back.

Do token approvals expire?

Token approvals do not expire. Ethereum.org’s guide says, “There are no expiration dates on contract permissions,” and a contract can use one even years after it was granted. Revoke.cash says that if you don’t revoke them, “the approvals stay active indefinitely.”

Disconnecting your wallet is not the same as revoking. Disconnecting only stops a website from seeing your wallet in your browser. The approval itself lives on the blockchain, attached to the token.

Action	What it does	Does the contract keep access?
Disconnect wallet from site	Site can no longer see your wallet	Yes
Withdraw funds from the app	Moves your tokens back to your wallet	Yes, for the approved token
Lower the allowance	Replaces the old amount with a smaller one	Only up to the new amount
Revoke (set allowance to zero)	Replaces the old amount with zero	No

Why do old approvals matter if the app was trustworthy?

Old approvals matter because good apps can still be hacked. Revoke.cash notes that “established projects get hacked,” so you could be “vulnerable even years after you last interacted with the project.”

Fake sites are the faster risk. Revoke.cash says “it’s easy to accidentally sign a malicious approval on a phishing website,” and in that case the scammer can drain your tokens shortly after you sign. Our explainer on crypto wallet drainers covers that pattern.

A hardware wallet protects your private keys, which matters a lot. But an approval you already signed is a separate path, because the contract uses transferFrom, not your keys. Our guide to hot and cold wallets explains what a hardware wallet does and doesn’t cover.

How do you check your token approvals?

You check token approvals by pasting your public wallet address into an approval checker and choosing a network. Ethereum.org lists several, including Etherscan’s Token Approvals page and Revoke.cash. Etherscan describes its page as a way to “review and revoke token approvals for any Ethereum address.”

1. Type the checker’s web address yourself. Don’t follow a link from a message or search ad.
2. Paste your public address. To look, you don’t need to connect anything.
3. Select the network. Approvals are kept separately on each network, so check each one you’ve used.
4. Sort by newest to oldest, as Revoke.cash suggests if something looks wrong.
5. For each row, ask: do I recognize this app, do I still use it, and is the allowance unlimited?

Etherscan adds a useful column: “The at risk amount shows what is vulnerable if the contracts were hacked.” If a spender shows only as a long address, paste it into a block explorer to see what that contract is before deciding. Screens and labels may differ in the current version of each tool.

How do you revoke a token approval safely?

You revoke a token approval by signing a new approval with the amount set to zero. Revoke.cash says revoking “is done by calling approve() again with the same parameters, but with the amount set to 0.” This works because EIP-20 says a new approve “overwrites the current allowance.”

1. Connect your wallet to the checker. Ethereum.org says to “use the same network in your wallet and website.”
2. Click Revoke on the approval you want to cancel. To keep access but lower it, Revoke.cash offers a pencil icon next to the approved amount.
3. Read the wallet confirmation. For a token it should show an approval with an amount of zero; for an NFT collection it should show approval set to false. It should show nothing that sends your tokens anywhere.
4. Pay the network fee and confirm. Ethereum.org notes “you will have to pay the fee for the cancellation to be successful.”

A real revoke tool never needs your seed phrase. And revoking won’t close positions you already hold in staking, pools or lending, according to Ethereum.org.

Is revoking every approval always worth it?

Revoking every approval isn’t always worth it. For an app you use every week, you’d pay a fee to revoke and then pay again to approve next time. That’s the reason unlimited approvals exist in the first place.

The better answer for apps you still use is a set limit, not unlimited. Revoking also can’t undo a loss that already happened. Revoke.cash says the point then is to stop the approval because it could be used again.

Your five-step token approval check

1. Paste your public address into a checker and go through each network you’ve used.
2. Sort newest to oldest and flag anything you don’t recognize or that shows unlimited.
3. Revoke what you’ve stopped using. If fees matter, start with unlimited approvals on your largest holdings.
4. For apps you still use, set a specific limit instead of unlimited.
5. Type the tool’s address yourself, and confirm the wallet shows an amount of zero before signing.

Run the check again each time you try a new app. If you also want to rule out look-alike addresses in your history, see our address poisoning check.

What to check next

Read every approval prompt for two things: the amount and the spender. Before you try a new app, decide in advance whether it gets a set limit or unlimited, rather than accepting whatever the pop-up suggests.

Sources

• ethereum.org: How to revoke smart contract access to your crypto funds
• EIP-20: ERC-20 Token Standard
• Revoke.cash: What are token approvals?
• Revoke.cash: How to revoke token approvals
• Etherscan: Token Approvals