Token Approvals and How to Revoke Them

To let a decentralised application move a token on your behalf, you sign an approval: a permission recorded on-chain that says a named contract may spend up to a certain amount of that token from your address. Swapping, lending and buying an NFT all begin with one. The permission is separate from the transaction that follows, and it does not expire on its own.

Why unlimited approvals are the problem

Many interfaces request an unlimited allowance by default, because it saves the user a second confirmation on every later interaction. The cost is that the contract keeps the right to move that token indefinitely. If the contract is later exploited, or was malicious from the start, or is upgradeable and its logic is swapped, the approval you signed months ago is what lets the funds leave — no key theft required.

How drains actually arrive

A fake mint page, an airdrop claim or a support impersonator asks you to sign what looks like a routine step. The confirmation screen shows an approval or a permit signature rather than a transfer, so nothing appears to move at the time. The transfer happens later, from the attacker's own wallet, using the permission you granted.

Reviewing and revoking

Use a reputable approval checker or your wallet's built-in permissions screen to list what each address has granted, per network — approvals are per chain, so a clean list on one network says nothing about another. Revoke anything you no longer use and anything unlimited on a contract you do not recognise. Revoking is itself a transaction and costs a network fee.

Habits that keep the list short

Set a spending cap instead of unlimited where the interface offers it, keep long-term holdings in a wallet that never interacts with applications, and read the confirmation screen for the word approve or permit before signing. A wallet that simulates transactions will show you the allowance in plain language.