Skip to content

← Tutorials

How to Review and Revoke Token Approvals

By moonbag.info team · · Intermediate

When you use a decentralized exchange, bridge or other app on Ethereum and similar (EVM) networks, you often grant it a token approval: permission for a smart contract to move a specific token from your wallet. Approvals are necessary for many apps to work, but they can stay active long after you’ve finished. If that contract is later exploited, or if you approved a malicious one, it can take your tokens without asking again.

How approvals work

Many tokens follow a standard (ERC-20 on Ethereum) with an “approve” function. When you approve, you set:

  • The token. For example, a stablecoin or “Token A.”
  • The spender. The smart contract allowed to move it.
  • The allowance. How much it may move.

Many apps request an unlimited allowance by default so you don’t have to approve again for every trade. That’s convenient but means the contract could move all of that token, now or in the future.

NFT collections have a similar setting, often called “set approval for all,” that covers every NFT in a collection.

Why it matters

  • Exploited contracts. If an app you used is hacked, attackers may use existing approvals to drain wallets that approved it.
  • Malicious contracts. Drainer scams trick people into approving an attacker’s contract, often through fake airdrops, mint pages or “claim” buttons.
  • Signature-based approvals. Some tokens and tools support approvals granted by an off-chain signature (for example “permit”-style messages). These don’t cost gas to sign, so they can feel harmless, but they can grant the same power. Read every signature request.

How to check your approvals

Several tools show active approvals for an address:

  • Block explorers for many EVM networks have a token approval checker page.
  • Wallet features. Some wallets show and revoke approvals in their settings.
  • Dedicated approval-checking sites.

Whichever you use, get to it from an official, bookmarked link. Fake “revoke” sites are a known scam. A checker only needs your public address to show approvals; it should never ask for your seed phrase.

Step-by-step: reviewing and revoking

  1. Open the approval checker for the network you use.
  2. Enter or connect your address. Viewing usually only needs the address. Revoking requires connecting your wallet.
  3. Review the list. For each approval, note the token, the spender (contract) and the allowance.
  4. Flag the risky ones:
    • Unlimited allowances.
    • Spenders you don’t recognize.
    • Apps you no longer use.
    • Anything granted recently that you don’t remember.
  5. Revoke. Click revoke next to an approval. Your wallet asks you to confirm a transaction that sets the allowance to zero.
  6. Check what you’re signing. The transaction should be a call to the token contract setting approval to zero for that spender. If your wallet shows something else, like a transfer, reject it.
  7. Pay the gas. Each revoke is an on-chain transaction with a gas fee. Prioritize large balances and unknown spenders if fees are high.
  8. Repeat on each network you use. Approvals are per network.

Good habits going forward

  1. Approve exact amounts when possible. Many wallets let you edit the allowance before confirming.
  2. Use a separate “hot” wallet for experiments. Keep long-term holdings, like a moonbag, in a wallet that never connects to new apps. See Hot vs. Cold Wallets.
  3. Review approvals regularly, for example monthly, and after using any new app or bridge.
  4. Be suspicious of free tokens. Unknown tokens that appear in your wallet often link to sites that ask for approvals. Don’t interact with them.
  5. Read signature requests carefully, especially “permit,” “set approval for all” or anything you don’t understand.
  6. Use a hardware wallet and read details on its screen.

If you think you’ve been drained

  1. Act quickly. Move remaining funds to a new, clean wallet created with a new seed phrase.
  2. Revoke approvals on the old wallet if anything is left that you can’t move.
  3. If you entered your seed phrase anywhere, assume the whole wallet is compromised. Revoking won’t help; move everything.
  4. Beware recovery scams. People who contact you promising to get funds back are almost always scammers. See How to Spot Crypto Scams.
  5. Report it. In the US, you can report to the FBI’s Internet Crime Complaint Center (IC3). Keep transaction hashes and screenshots.

What revoking can’t do

Revoking stops a contract from moving tokens in the future. It can’t reverse transactions that already happened, and it can’t protect a wallet whose seed phrase or private key has leaked.

Common mistakes

  • Never checking approvals.
  • Using a fake revoke site.
  • Revoking on one network but not others.
  • Signing “gasless” messages without reading them.
  • Interacting with unknown airdropped tokens.
  • Keeping long-term funds in an experimental wallet.

Key takeaways

  • Approvals let contracts move your tokens, and they persist until revoked.
  • Unlimited approvals and unknown spenders are the biggest risks.
  • Review approvals regularly from official tools and revoke what you don’t need.
  • Separate experimental wallets from long-term holdings.