How to Revoke Token Approvals

When you sign a token approval, you’re letting a smart contract pull a set amount of one token out of your wallet. You can’t swap on a decentralized exchange or list an NFT without granting one first.

The catch is that they don’t switch themselves off. An approval you gave for a swap years ago can still be sitting there, wide open.

Revoke.cash counts more than $362M taken in approval hacks since 2020, so we think cleaning them up is worth a few minutes of anyone’s time. We’ll go through how approvals work, where the danger sits, and the steps for removing them in Revoke.cash, Etherscan, MetaMask Portfolio and a Solana tool.

So What Is a Token Approval, Anyway?

Revoke.cash’s own definition is short: an approval lets a smart contract spend your tokens for you. A smart contract is a program living on the blockchain; a decentralized exchange is one, and so is a lending protocol.

Picture swapping USDC for ETH on a DEX. The exchange first wants its contract approved to take your USDC.

You sign, you pay gas, and only after that does the swap go through. If that flow’s new to you, our walkthrough on using a decentralized exchange covers it step by step.

A handful of terms keep coming up:

• The spender is whichever contract address gets the permission.
• What that spender is still allowed to take is the allowance, and MetaMask’s name for it is a spending cap.
• With an unlimited approval, the allowance is set so high that it covers your entire balance, including tokens you add later.
• To revoke is to push that permission back to zero, which takes a fresh on-chain transaction.

None of this touches your keys. Your wallet address and seed phrase don’t change; an approval is only an entry on the chain saying one contract may move one token.

What Happens When You Approve a Token

All of this traces back to ERC-20, the token standard Fabian Vogelsteller and Vitalik Buterin wrote in November 2015. Three of its functions do the work.

1. First you call approve, giving it a spender and an amount; per the standard, the spender may then withdraw from your account multiple times, up to that figure.
2. Calling allowance tells you how much that spender has left to withdraw.
3. Once you use the app, its contract calls transferFrom to move the tokens.
4. Revoking is approve once more, this time with the amount at 0.

A bank standing order is a decent comparison. It keeps paying out until you cancel it, even if you quit that store years back.

Ethereum.org says as much: contract permissions don’t come with an expiry date, and they can still be used years after you granted them.

Plenty of legitimate apps request what MetaMask calls essentially unlimited amounts, so regular users aren’t paying for a fresh approval on every visit. Since each approval is its own on-chain transaction, that does save gas. The trade-off is that the contract hangs on to access to your entire balance of that token.

Approvals for NFTs Go Further

NFTs follow slightly different rules. ERC-721 gives you approve for one NFT, plus setApprovalForAll, which hands an operator control over every NFT you own in that collection.

According to Revoke.cash, most NFT marketplaces rely on the whole-collection version.

MetaMask’s warning bears repeating: you shouldn’t need to sign that kind of approval to receive something. A “free mint” or airdrop page asking for it is a reason to close the tab.

Permit Signatures and Uniswap’s Permit2

Some approvals never show up as a transaction at all. EIP-2612, from April 2020, added a permit function that sets an allowance using a signed message.

You sign off-chain and pay no gas. The app switches the approval on later.

That’s the part Revoke.cash worries about. With no transaction, wallets show fewer warnings, and people believe they’re logging in while they’re handing over an approval.

Cancelling a permit before it’s been used is very hard. After it’s activated on-chain, though, it behaves like any other approval and you can revoke it.

Permit2, built by Uniswap, stretches the same idea to any token. You approve Permit2 one time per token, usually for the maximum, and it then gives out sub-approvals to apps.

Those sub-approvals come with an expiry, which we count as a genuine improvement. You’re still left with two layers to tidy up: the approval you gave Permit2 and each Permit2 approval sitting beneath it.

Why Old Token Approvals Are Risky

Once a contract is approved, it can spend your tokens whenever it likes. Revoke.cash sees two ways this turns bad: a legitimate contract gets hacked, or a phishing site talks you into approving a malicious one.

Hacks of contracts people trust come up again and again. These three followed the same script:

• SushiSwap’s RouteProcessor2 contract was exploited on April 8, 2023, and roughly 1,800 WETH left the wallets of people who’d approved it. Sushi’s advice was to look for leftover approvals on revoke.cash or sushi.com.
• Socket, the bridge tech under Bungee Exchange and Rainbow Wallet’s bridge, was hit on January 16, 2024, and users with live approvals to it lost over 3 million dollars.
• LI.FI came next on July 16, 2024, when $11.6 million went from wallets holding infinite approvals to its contract.

None of those victims slipped up on the day. They’d used a genuine app at some point and never removed the approval.

Anyone who’d revoked beforehand wasn’t exposed.

Nor does a hardware wallet fix this, and Revoke.cash doesn’t hedge on the point. Approvals don’t require anyone to steal your keys, so the device gives you no extra protection here.

For keeping keys safe, our pick of the best hardware wallets for MetaMask still stands. You need to look after approvals as well, that’s all.

There are things revoking can’t do. It won’t bring back stolen funds.

If a sweeper bot grabs every bit of ETH the second it lands, the seed phrase itself has leaked. Revoke.cash is blunt about that situation: revoking won’t save the wallet, so abandon it and set up a new one.

How to Revoke Token Approvals, Tool by Tool

Whichever EVM tool you pick, the routine barely changes. You find your approvals, choose the ones to kill, and send a transaction that zeroes them.

You’ll pay an ordinary network gas fee for each revoke. Ethereum.org points out that revoking should never result in a loss of funds.

One warning before you start moving anything. A revoke doesn’t send funds, but any transfer you make during the cleanup is final, and if the address or network is wrong, that money’s gone and nobody can reverse it.

Revoking With Revoke.cash

1. Type revoke.cash into your browser yourself.
2. Put your address or ENS name in the search bar, or hit “Connect Wallet”. Looking only needs the address; connecting is for the revoking part.
3. Pick the network.
4. If you suspect a recent approval was malicious, sort by “Newest to Oldest”. Filtering or searching by spender address works too.
5. Press “Revoke” beside an approval, then confirm in your wallet. Rather shrink an allowance than remove it? Click the pencil icon and type a lower number.

You don’t pay for the core tools. At the time of writing (September 2026), Premium is $99/year and drops batch revoke fees across chains.

Ultimate, at $199/year, layers on continuous monitoring, automated revoking and a $5/month gas budget. On the free plan, the Exploit Checker checks your approvals against known hacks on a single chain.

There’s a Signatures tab for permit signatures as well. It can only list signatures you might have signed, because no website can see which off-chain messages you really did sign.

Using Etherscan’s Token Approval Checker

1. Head to Etherscan and pick Token Approvals under the “More” menu.
2. Type in your address, then open the ERC-20, ERC-721 or ERC-1155 tab.
3. Switch “Show all approvals” on.
4. Connect a wallet, tick whatever you want gone, and hit “Revoke Selected”. Your wallet will ask you to sign each transaction.

We like that it shows the total value at risk, since that tells you where to start. BscScan and Polygonscan work the same way for BNB Chain and Polygon.

Revoking Spending Caps in MetaMask Portfolio

1. Open MetaMask Portfolio with MetaMask connected.
2. Go to the Overview tab and flip over to “Spending Caps”.
3. Hit the revoke button beside a cap and approve the transaction in MetaMask.

It handles five networks and no more: Ethereum Mainnet, Polygon, BNB Chain, Optimism and Base. Anything else means a trip over to Revoke.cash, which annoys us a little.

Still picking a wallet? Our MetaMask vs Trust Wallet comparison looks at the rest of what each one does.

What About Solana and Phantom?

Solana skips ERC-20 approvals altogether. Its token program has a delegate instead, an address that may transfer or burn tokens from one of your token accounts.

Revoke that and the delegate is wiped, with the delegated amount back at zero.

For Solana, Phantom’s help center sends people to the Famous Foxes tool at famousfoxes.com/revoke. Connect Phantom, then choose “Revoke all”.

On EVM chains inside Phantom, it refers you to ethereum.org’s revoke guide instead.

If You Sign With a Hardware Wallet

Your hardware wallet treats a revoke like any transaction, so you’ll confirm it on the device just as you would a send. Got a long list to clear? Rabby Desktop version 0.39.0 brought batch revoking with Ledger.

Habits That Keep Token Approvals Under Control

• Put a spending cap on approvals as you grant them. MetaMask lets you type your own number rather than picking “Max” or “Use site suggestion”, and says never granting unlimited allowances is the safest route.
• Clear out approvals for apps you’ve stopped using. Revoke.cash says existing deposits and positions stay put and you can still withdraw.
• Whenever an app you’ve used gets hacked, run the Revoke.cash Exploit Checker.
• Slow down on signature requests. If a so-called login message mentions a spender, an amount or Permit2, it’s an approval.
• We’d treat any free mint or airdrop asking for setApprovalForAll as a scam.
• Enter the revoke tool’s address by hand instead of clicking a link somebody sent.
• Try new apps from a separate wallet, and keep long-term funds in one that almost never signs anything. Our custodial vs non-custodial wallets explainer covers why that job falls to you.

Mistakes People Make When Revoking Approvals

• Hitting disconnect and assuming you’re done. All that does is stop the site seeing your address, and the approval stays live until it’s revoked.
• Looking at a single network. Approvals live on each chain separately, so a Base approval won’t appear while your tool is set to Ethereum; go through every chain you’ve used.
• Clearing the individual Permit2 approvals but forgetting the one you gave Permit2 itself. Revoke.cash suggests removing that too once you’re not using it.
• Topping up a drained wallet with ETH to pay for revokes. With a sweeper bot running, the ETH vanishes before any revoke goes through, so start a new wallet.
• Handing money to a “recovery service”. According to Revoke.cash, someone promising to get stolen assets back is likely a scammer.
• Believing a hardware wallet stops approval exploits. The device guards your keys; it does nothing about approvals you’ve already signed.

Quick Answers on Revoking Token Approvals

Our Take on Revoking Token Approvals

Approvals are how apps move your tokens, and they don’t go away until you revoke them. The SushiSwap, Socket and LI.FI hacks hit people whose only slip was leaving old approvals open.

We think a few minutes in Revoke.cash, Etherscan or MetaMask Portfolio, along with spending caps on anything new, is time well spent against the next hacked contract.

Just don’t expect revoking to reverse a theft. It won’t rescue a wallet with a leaked seed phrase either; in that case Revoke.cash says to walk away from the wallet and create a fresh one.

This article is for general information only and is not financial, legal, or investment advice. Prices and features change; check the vendor’s official page before buying.