Token Approvals Explained: How to Check and Revoke Them

When you swap an ERC-20 token — USDC, WBTC, LINK, almost anything that isn't the chain's native coin — there are actually two transactions. First an approval, where you grant the exchange contract permission to move that token. Then the swap itself.

That two-step design is deliberate and sensible: it means a contract can never touch a token you haven't explicitly authorised. The problem is what happens afterwards.

The approval doesn't expire

Once granted, an approval stays live until you actively remove it. Many apps request an unlimited allowance by default, because it means you only pay approval gas once instead of before every trade. Convenient — and it means that contract retains permission to move that token from your wallet indefinitely.

To be clear about the actual risk: this is not a claim that any particular exchange will steal from you. The risk is time. An approval you granted eighteen months ago to a protocol you've forgotten is still active. If that contract is ever exploited — and DeFi contracts do get exploited — the attacker inherits every permission it holds.

The danger isn't granting an approval. It's that approvals accumulate silently and never expire, so your exposure only ever grows.

Why this is different from being hacked

An approval-based drain doesn't require your seed phrase. Nobody needs to break your wallet. The permission you already signed is sufficient — which is why this class of loss catches people who consider themselves careful.

It's also why non-custodial trading removes one category of risk but not all of them. Your keys stay yours; the permissions you've handed out are a separate surface entirely.

How to audit and revoke your approvals

1. Open an approval checker

The best known is Revoke.cash. Etherscan and most block explorers also have a "Token Approval Checker" under their tools menu. Pick the network you want to review first.

2. Connect your wallet

Connect the wallet you want to audit. Building the list only reads public blockchain data — no signature required just to look. As always, type the URL yourself rather than following a link from a DM or search ad.

3. Read the list honestly

You'll likely see more than you expect. Prioritise:

• Unlimited allowances on tokens you hold real value in.
• Contracts you don't recognise, or protocols you used once and abandoned.
• Anything from a site you no longer trust or that has since gone quiet.

4. Revoke

Select the approval and choose revoke. Your wallet asks you to sign a transaction that sets the allowance to zero. Your tokens don't move and aren't at risk during this — you're only editing a permission.

5. Repeat per chain

This is the step people miss. Approvals are per network. Cleaning up on Ethereum does nothing for your Base, Arbitrum, Polygon or BNB Chain approvals. Work through each network you've actually used.

What it costs

Each revoke is an on-chain transaction, so you pay gas. On Ethereum mainnet that might be a few dollars per approval, which is worth budgeting for if you have many. On Base, Arbitrum and similar layer 2 networks it's typically well under a cent — clean those up freely.

Solana works differently: SPL tokens use a delegate model rather than ERC-20 style allowances, but the principle holds. Review what you've delegated and revoke what you don't need.

Sensible habits going forward

• Prefer finite approvals where the interface offers a choice. Approving exactly what you're swapping means nothing is left standing afterwards.
• Audit on a schedule. Ten minutes each quarter is enough.
• Use a separate wallet for experiments. Keep long-term holdings in a wallet that never touches unfamiliar contracts.
• Read what you're signing. If a site asks for approval on a token you weren't trading, stop.

None of this makes you paranoid — it makes you current. Approvals are one of the few risks in self-custody that you can eliminate completely in an afternoon.

Keep reading: How to spot a scam token · Non-custodial trading explained