Wallets and Security
Token Approvals Explained and How to Revoke Them
What token approvals are, why unlimited approvals create risk long after you use a dApp, how to check existing approvals and how to revoke the ones you no longer need.
Every time you trade on a decentralised exchange, deposit into a lending app or list an NFT, you probably grant a token approval. Approvals are a normal part of how DeFi works. They are also one of the most overlooked risks in crypto, because they often stay active long after you stop using the app.
What an approval is
Tokens following the common ERC-20 standard cannot be pulled from your wallet by a contract unless you allow it. An approval sets an allowance: a contract address, called the spender, may move up to a certain amount of a specific token from your wallet.
When you swap tokens, the exchange contract needs permission to take the tokens you are selling. You approve it, then the swap happens. NFTs have a similar mechanism, often granting control over a whole collection.
Why unlimited approvals are risky
Many apps request unlimited approvals so users do not need to approve again for each transaction. That convenience comes with a cost. If the spender contract is later exploited, or if the approval was granted to a malicious contract, the attacker can take every unit of that token in your wallet, now or years later.
The risk grows with time. Old approvals to apps you no longer use, or to contracts that have since been upgraded or abandoned, remain active until you revoke them.
Signs of a risky approval
Look out for:
- Unlimited allowances on tokens you hold in large amounts
- Approvals to contracts you do not recognise
- Approvals granted while using a site you are no longer sure was genuine
- NFT approvals for all items in a valuable collection
- Approvals to apps that have announced exploits or shut down
How to check your approvals
Several reputable tools and block explorers show active approvals for an address:
- Open a trusted approval checker or the token approval section of a block explorer
- Enter your wallet address or connect in read-only mode
- Choose the network you want to review, since approvals exist per network
- Review the list of tokens, spenders and allowance amounts
Bookmark the tool you use. Fake revoke sites are a common scam, and some drainers pretend to be approval checkers.
How to revoke
Revoking sets the allowance to zero with a new transaction:
- Select the approval you want to remove
- Confirm the transaction in your wallet, which costs a small gas fee
- Wait for confirmation and refresh the list
Prioritise revoking approvals for high-value tokens, unknown spenders and apps you no longer use. On networks with low fees, revoking many approvals costs little.
Safer approval habits
| Habit | Benefit |
|---|---|
| Approve only the amount needed | Limits loss if the contract is exploited |
| Use a separate wallet for new apps | Keeps main holdings out of reach |
| Review approvals monthly | Catches forgotten allowances |
| Check spender addresses in the prompt | Confirms you are approving the right contract |
| Prefer apps that request exact amounts | Reduces lingering risk |
Many wallets now let you edit the approval amount before confirming. Use that option when it is available.
Payments never need approvals
A simple payment is a direct transfer, which needs no approval. If a checkout or claim page asks you to approve tokens before paying or receiving something, stop and check carefully. Proud Globe payments, for example, are plain USDC or USDT transfers to a published address, and the order page never asks for an approval.
Educational content only. Nothing here is financial, legal or tax advice. Crypto assets carry risk, so check the details for your own situation.
