Revoking token approvals
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
Using DeFi or NFTs leaves behind approvals — standing permission for a contract to move your tokens. They stay valid until you explicitly cancel them, and a contract later exploited becomes a route into your wallet. Review the list periodically and revoke what you no longer use.
Key points
- Approvals survive disconnecting from a site; cancelling them is a separate action
- An unlimited approval hands over the power to move your whole balance at any later time
- Revoking is an on-chain transaction, so it costs gas
- Verify the domain of any revocation tool you use — look-alikes are common
Definition
An on-chain transaction that cancels a permission (an approval) previously granted to a contract to move your tokens. Lingering approvals are one of the main routes by which wallets are drained.
Understanding why approvals exist makes the judgement easier. Swapping on a DEX or listing an NFT requires a contract to move tokens on your behalf. Asking permission for every single trade would be unusable, so the design grants up-front permission for a contract to move a given token up to a given amount. That is an approval.
The problem is that this permission has no expiry. Once granted it remains valid until explicitly cancelled, and because many sites default to an unlimited amount, users routinely create a situation where a contract can move their entire balance at any time. If that contract is later found to have a vulnerability, or its operators turn hostile, a service you used once years ago becomes the way your wallet is emptied.
The clean-up broadly runs as follows. Use a tool that lists approvals, enter your address, and see which contracts hold permissions over which tokens. Revoke.cash is a well-known example, and checking by address alone does not require connecting a wallet. Keep that distinction in mind: checking and revoking need different levels of access.
Selecting an approval to cancel raises a signing request in your wallet. Only at this point are a connection and a signature needed, and because it executes as an on-chain transaction it costs gas. If many approvals have piled up, cancelling them one at a time adds up, so it is practical to start with the tokens holding the most value and the obviously abandoned old contracts.
As an ongoing practice, separating the address holding significant value from the address you use to try new dApps works well. Keep only what you need in the experimental one, so that even as approvals accumulate there, the maximum loss is bounded. Designing for an affordable loss beats trying to keep the clean-up perfect.
Watch out for
- · Fake sites posing as revocation tools are plentiful. Confirm the official domain yourself and never arrive via a search advert or a social link
- · Revoking never involves entering a seed phrase or private key. Being asked for one means it is a scam
- · Revoking after a drain does not bring back what has already gone. Periodic review is prevention, not remediation
Frequently asked questions
Does revoking break the service I used it with?
No — you are simply asked to approve again the next time you use it. Since each revocation costs gas, the practical approach is to keep approvals for services you use regularly and clear out the ones you do not.
How often should I review approvals?
There is no fixed rule, but after trying a batch of new dApps, or when a service you use is reported to have a problem, are natural moments to look. Making it a routine means you can react faster when it matters.