Wallet Approvals: How to Find and Revoke Risky Permissions
Every token approval you've ever signed may still be live, letting someone else move your coins. Here's how allowances work, how drainers abuse them, and a routine for cleaning them up without breaking the apps you use.
Key takeaways
- →An approval lets a smart contract move your tokens later, without asking you again, until you revoke it.
- →Unlimited approvals are the default in many apps, and they stay live for years if you never touch them.
- →Signing an off-chain 'permit' message can grant spending rights without any transaction or gas fee, which is why drainers love it.
- →Revoking costs a small network fee per approval, so prioritise by value at risk and by how much you trust the contract.
- →Hot wallets with few approvals and small balances limit the damage when something goes wrong.
Click 'Approve' in a crypto app and you haven't sent anything. You've handed a smart contract permission to take your tokens later, whenever it likes, up to a limit you probably never read. That permission doesn't expire. It sits on the blockchain until you cancel it, and most people never do.
It's how a wallet you haven't touched in months can get emptied overnight. Nobody stole your seed phrase. Nobody hacked your device. A contract you approved two years ago got exploited, or a site tricked you into approving the wrong one, and the allowance did exactly what it was built to do.
What a token approval actually is
Most tokens on Ethereum and similar chains follow a standard (ERC-20 on Ethereum, with close equivalents on other EVM chains). It includes two functions you need to know: approve and transferFrom.
Your wallet can send tokens directly. A smart contract, like a decentralised exchange or a lending protocol, can't reach into your wallet by itself. So the token standard gives you a way to authorise it. You call approve(spender, amount), which writes a number into the token's records: 'this spender may move up to this much of my balance'. Later the spender calls transferFrom to pull tokens out, and the token contract checks that number first.
Three things follow from that design:
- The approval lives on the token contract, not in your wallet app. Delete the app, switch browsers, reinstall your wallet. Nothing changes.
- It applies to tokens you receive later. Approve unlimited USDC with a zero balance, deposit 5,000 USDC next year, and the spender can take all 5,000.
- It only covers that one token, on that one chain. Approving a token on one network grants nothing on another.
NFTs work similarly, just blunter. The setApprovalForAll function gives an operator control over every NFT you hold in an entire collection. No amount. All or nothing.
Why unlimited approvals are everywhere
Apps usually ask for the maximum possible number, a figure so large it's effectively infinite. Your wallet may show it as 'Unlimited'.
It's about convenience. Each approval is its own on-chain transaction with its own fee. If the app asked for exactly 100 tokens, you'd have to approve again the next time you traded 101. Unlimited means one approval, forever. Fewer clicks, fewer fees, fewer abandoned transactions.
The price is risk. An unlimited approval is only as safe as the contract stays, for as long as the approval exists. Code gets upgraded. Admin keys get compromised. Bugs turn up years after launch. Your approval doesn't care about any of it.
How drainers exploit approvals
Drainers are scripts and phishing kits built to harvest approvals. They tend to work in one of three ways.
Fake sites asking for real approvals
A cloned exchange, a fake airdrop claim or a 'wallet verification' page asks you to approve a token. The spender address belongs to the attacker. The moment you confirm, their bot calls transferFrom and moves your balance out, often within seconds.
Off-chain signatures (permits)
This one catches experienced users. Some tokens support a permit function, and some apps use shared approval systems that work the same way. You sign a typed message, not a transaction. No gas fee, and nothing seems to happen on-chain. But anyone can submit that signature later to create an approval.
It costs nothing and looks like a login prompt, so people sign without thinking. Your wallet may show fields like spender, value and deadline. If the spender is unfamiliar and the value is huge, you've just handed over your tokens.
Exploited legitimate contracts
Sometimes you did nothing wrong at the time. You approved a real protocol, it later had a vulnerability that allowed arbitrary transferFrom calls, and the attacker drained every wallet with a live approval. Old, forgotten approvals to abandoned projects are the worst offenders.
Where to see your approvals
Approvals are public on-chain data, so you can look them up for any address. A few options:
- Block explorers. Explorers for major EVM chains generally have a token approval checker page where you connect your wallet or paste an address.
- Dedicated approval tools. Independent revoke tools scan multiple chains at once and show token, spender, allowance amount and estimated value at risk.
- Wallet built-ins. Some wallets and security extensions now list approvals and warn on risky signatures. Coverage varies.
Whichever you pick, get there by typing the address yourself or using a bookmark. Fake 'revoke' sites are a known drainer trap. The irony stings.
The audit-and-revoke routine
Run this every month or two, and right away after any scare.
- List your active addresses and chains. Write down every wallet address you use and every network you've transacted on. Approvals on a chain you forgot about still count.
- Open an approval checker from a bookmark. Paste in your address rather than connecting the wallet if you only want to look. Reading is free and harmless.
- Sort by value at risk. Start with approvals covering tokens you actually hold in meaningful amounts. An unlimited approval on a token you have zero of is low urgency, unless you plan to receive more.
- Identify every spender. Check the spender name or address. Is it a protocol you recognise and still use? If the tool shows an unknown address or an unverified contract, treat it as hostile.
- Put each approval in one of three buckets. Revoke now: unknown spenders, projects you've abandoned, anything flagged as exploited. Reduce: apps you use occasionally. Keep: apps you use weekly and trust.
- Revoke the first bucket. Connect your wallet, click revoke on each, and read the wallet confirmation screen. A revoke is just an approval set to zero, so you'll see an approve call with an amount of 0 and the same spender. Pay the network fee.
- Handle NFT approvals separately. Look for setApprovalForAll entries, especially to old marketplaces. Revoking sets the approval to false.
- Re-scan to confirm. Refresh the checker after the transactions confirm. The revoked entries should show zero or disappear.
- Next time you use an app, approve a set amount. Many wallets let you edit the requested allowance before confirming. Enter what you need for this trade or deposit, not unlimited.
Revoking doesn't break apps for good. The next time you use that app, it'll just ask for approval again. That's the whole trade-off: an extra click and fee in exchange for not leaving a door open.
Worked example: deciding what to revoke
All figures here are hypothetical, chosen to show the reasoning.
Say a wallet holds 3,000 USDC and 1.5 of a staked-ETH token worth roughly 4,500 dollars at the time. Assume each revoke costs around 2 dollars in fees on this network. The scan shows five approvals:
| Token | Spender | Allowance | Value at risk | Decision |
|---|---|---|---|---|
| USDC | DEX router you use weekly | Unlimited | $3,000 | Reduce or keep |
| USDC | Yield farm you left last year | Unlimited | $3,000 | Revoke |
| Staked ETH | Unknown contract, unverified | Unlimited | $4,500 | Revoke immediately |
| Old meme token | Defunct launchpad | Unlimited | $0 (zero balance) | Optional |
| NFT collection | Marketplace you still use | All | Depends on floor | Keep for now |
Revoking the two clearly bad ones costs about 4 dollars and removes exposure on 7,500 dollars' worth of tokens. Obvious.
The meme token approval is the interesting one. Zero balance today means zero risk today. But if an airdrop or a mistaken transfer drops tokens there later, they're exposed. For 2 dollars, plenty of people would revoke it anyway. On a chain where fees spike to 30 dollars, you might leave it.
The weekly DEX approval is a judgement call. Keeping it saves fees and friction. Cutting it to, say, 500 USDC limits the damage if the router is ever compromised, but you'll re-approve more often. The cleaner answer is structural, and that's next.
Set up your wallets so approvals matter less
The best defence isn't revoking faster. It's making sure a bad approval can't reach much.
- Split hot and cold. Keep most funds in a wallet that never connects to apps. Move only what you need into a separate 'hot' wallet for trading, gambling sites or new protocols.
- Use a burner for anything new. Airdrop claims, mints and unfamiliar dapps get a fresh address with a tiny balance. If it gets drained, you lose pocket change.
- Use a hardware wallet for the vault. It forces you to confirm on a separate screen, which slows down impulse signing.
- Install signature warnings. Wallet security extensions that simulate transactions and flag permits can catch a malicious signature before you confirm it.
Common mistakes
- Thinking a disconnect revokes anything. Clicking 'disconnect' on a site just stops it reading your address. Approvals stay live on-chain.
- Ignoring gasless signatures. No fee, so people assume no risk. Permit signatures are some of the most effective drainer tools for exactly that reason.
- Revoking via a link someone sent you. Support 'agents' in chats and DMs love pointing panicked users to fake revoke tools. Use your own bookmarks.
- Only checking one chain. You bridged once to a cheaper network, tried a farm, and forgot. That approval is still there.
- Revoking after a drain and stopping. If your seed phrase or private key was compromised, revoking won't help. The attacker can sign anything. Move remaining funds to a brand-new wallet.
- Racing an active drainer with a revoke. If tokens are being pulled out right now, a revoke can lose the race. Moving tokens to a safe address may be faster, though bots can front-run that too.
- Approving unlimited by habit. Editing the amount takes five seconds in most wallets.
FAQ
Does revoking an approval return stolen tokens?
No. Revoking only stops future transfers. Anything already moved through transferFrom is gone from your wallet, and on public blockchains it's rarely recoverable. That's why the routine is preventive, not a rescue tool.
Should I revoke everything to be safe?
You can, but you'll pay a fee for each revoke and another for each re-approval when you return to an app. For trusted apps you use often, a limited approval in a dedicated hot wallet is usually the better balance. Revoke everything only if you suspect the whole wallet is compromised, and in that case move to a new address too.
Do approvals work the same way on Bitcoin or Solana?
Plain Bitcoin transfers don't use a token approval system like this, so the risk looks different. Solana has its own delegation model, where a token account can name a delegate with a set amount, and drainers target it with malicious transactions too. The principle carries over: know what you're authorising, and check your wallet's delegate or permission list on any chain you use.
The uncomfortable truth is that your wallet's security today depends partly on decisions you made long ago, in apps you've forgotten, on sites that may not exist anymore. When did you last check what you've signed?
