Token approvals: how to check them and revoke what you no longer need

Quick triage: which approvals matter most

If you only have five minutes, look for these in order. This ranking is editorial judgement based on how much damage each can do.

1. NFT operator approvals to addresses you do not recognise. They cover a whole collection with no amount cap.
2. Unlimited ERC-20 allowances to unknown spenders, especially on stablecoins or large holdings.
3. Permit2 approval on tokens you no longer swap, since one approval underlies many sub-permissions.
4. Old allowances to small or defunct apps. A contract that was safe when you used it can be upgraded or compromised later.

What an approval actually is

Tokens on EVM chains do not move because a contract asks nicely. A contract can only pull tokens from your address if you earlier told the token contract it may. That permission is the approval, stored on-chain as a number or a flag.

Two separate things can therefore be live at once for the same token: an approval to the app directly, and an approval to Permit2 plus sub-approvals inside Permit2. A good review looks at both. Revoke.cash recommends revoking the approval to the Permit2 contract itself when you no longer use Permit2, given phishing risk, and letting near-expiry sub-approvals lapse while revoking or updating far-off ones manually (Revoke.cash).

Why approvals persist

Ethereum.org states that granted permissions remain usable indefinitely and that disconnecting your wallet from a project does not remove them (source). The reason is architectural. The wallet connection is a browser session; the approval is data inside the token contract. Closing the tab changes the first and not the second.

This produces the typical failure mode: an unlimited approval you gave a legitimate app two years ago, then that app’s contract is exploited or you later receive a lookalike request that you never notice. Ethereum.org adds that once an unlimited allowance is granted, the platform can spend those tokens even after you move funds back into your wallet.

The seven steps

These steps follow the Revoke.cash and Etherscan flows described in Revoke.cash’s guide and the ethereum.org walkthrough, with our safety additions.

1. 1

   Use a clean device or profile and the right address

   Open the checker in a browser profile with no unknown extensions. Enter or connect the wallet address that signed the approvals. Searching an address is read-only; connecting is only needed to revoke.

2. 2

   Select the network

   Approvals are stored per chain, so the same wallet needs a separate review on each network it has used. Revoke.cash lists 80+ networks; on others, use that chain’s block explorer.

3. 3

   Sort approvals from newest to oldest

   Revoke.cash suggests this order when hunting for a suspicious approval. Unknown spender addresses signed recently deserve attention first.

4. 4

   Triage each approval

   For each row note the token, the spender, the allowance and the last-updated date. Unlimited allowances to spenders you cannot name are the priority.

5. 5

   Revoke, or lower the amount

   Click Revoke on the approval, or use the edit option to set a lower allowance if you still use the app. Both require a transaction and a network fee.

6. 6

   Confirm in your wallet and wait

   Check the wallet popup shows an approval call setting the allowance to zero, then wait for the transaction to finish. Processing time varies by network.

7. 7

   Refresh and verify

   Reload the checker after a few minutes. The approval should be gone or show zero. Repeat for each chain and each token standard.

Revoke.cash vs block explorer checkers

Our practical advice: use whichever you can reach through a bookmark you made yourself. Fake revoke sites exist, and a revoke tool that asks you to sign anything other than an allowance reset or approval-flag change is a red flag. Etherscan’s own page warns that the service is provided as is and that it is not responsible for losses from using it, so read each wallet prompt rather than assuming the tool is correct. Some explorers block automated readers; we only describe the pages we could open.

What revoking costs

Revoking is a normal on-chain transaction, so you pay the network fee. Ethereum.org says processing time varies from about a minute to several minutes depending on network. We do not quote a dollar figure because fees change with congestion and chain. Two practical points.

• Budget by chain. A review across five networks means up to five rounds of fees, and you need a little of each network’s native token in the wallet.
• Prioritise by risk, not by completeness. If fees are high, revoke the NFT operator and unlimited stablecoin approvals first, and leave tiny dust allowances for later.

Revoking does not end staking, pooling or lending positions or stop rewards, according to ethereum.org. You will simply need to approve again next time you use that contract.

The Solana equivalent

Solana has no setApprovalForAll or ERC-20 allowance table. Instead each token account stores one current delegate and one delegated amount at a time. Approving a new delegate replaces the earlier one. The token account owner signs the approval through the Approve or ApproveChecked instruction (Solana docs).

To remove it, the Revoke instruction clears the delegate and sets the delegated amount to zero. Under the Token Program the token account owner signs it; under the Token Extension Program the current delegate can also revoke (Solana docs). We did not open the spl-token command-line documentation, so we do not give command syntax here.

The risk profile differs. A delegate is capped at a stated amount and there is only one per token account, so exposure is bounded per token. But a single malicious delegate approval for a full balance still lets the attacker move it. Another common Solana loss comes from signing a transaction that transfers assets or changes account ownership, which is not an approval at all and cannot be revoked afterwards. See our Solana ecosystem page for the airdrop context and the scam guide for patterns.

Limits: what revoking cannot do

It does not return stolen funds.

Blockchain transfers cannot be reversed. Revoking prevents the next theft only.

It does not help if the private key leaked.

If someone has your seed phrase or key, they can simply sign new transactions. Migrate to a new wallet.

It does not cancel a signed but unused permit unless you act.

EIP-2612 says a signed permit can be submitted by anyone until its deadline, and the owner can invalidate it by changing the nonce, for example by submitting a permit or using the nonce themselves. A short deadline limits exposure; a deadline set to the maximum value effectively removes expiry. A revoke tool may not show such an off-chain signature, so treat any suspicious permit as a reason to move funds.

It is per chain and per token standard.

Ethereum, Base, Arbitrum and others each hold their own approvals. See Ethereum, Base and Arbitrum for where you may be active.

Recurring hygiene checklist

Pair the checklist with the habits in the burner wallet guide, and use our legitimacy scorer before signing the next claim. If you are building an activity history across many apps, airdrop farming generates approvals faster than almost any other habit, so review more often.

Written and fact-checked by the airdrop.promo Editorial Team. Method: how we verify. Spotted an error? contacts@airdrop.promo. Educational content only, not financial or tax advice.