How to Check and Revoke Token Approvals (and Why Old Ones Are Dangerous)

On Ethereum and other EVM chains, a smart contract cannot take tokens from your wallet on its own. You have to give it permission first, with a transaction called an approval. Every swap on a decentralised exchange, every deposit into a lending app and every NFT listing usually starts with one.

Approvals are necessary, but they do not expire. A permission you granted to an app two years ago is still valid today unless you removed it, and if that contract is later exploited, or if the approval was granted to a malicious contract in the first place, the tokens it covers can be moved without any further signature from you.

What an approval actually is

An ERC-20 token keeps a record called an allowance: for each pair of owner and spender, how many tokens the spender may transfer on the owner's behalf. When you approve an app, you set that number for the app's contract.

• Limited approval: the allowance equals the amount you are about to use. Once spent, it is back to zero.
• Unlimited approval: the allowance is set to the maximum possible value, so you never have to approve that token for that app again. Most apps request this by default because it saves you a transaction next time.
• NFT approval for all: setApprovalForAll lets one operator move every NFT you own in that collection, now and in future.
• Signature permits: some tokens support permit signatures, and services such as Permit2 manage allowances through a signed message rather than an on-chain approval. You sign a message instead of sending a transaction, which is why a harmless-looking signature request can still grant spending rights.

How approvals get abused

• A drainer site asks for one. A fake airdrop claim, a cloned mint page or a counterfeit exchange asks you to "connect and approve". The spender is the attacker's contract, and once approved it sweeps the token.
• A legitimate contract is exploited later. If a protocol you once used is compromised, an attacker can use the standing approvals users gave it.
• A signature you did not read. Off-chain permit signatures do not show up as a transaction in your history, so people often do not realise they granted anything.

How to check your approvals

You can see every active approval without connecting anything risky, because allowances are public on the chain.

1. Open a block explorer's approval checker. Etherscan has one at etherscan.io/tokenapprovalchecker, and the equivalent explorers for other EVM chains offer the same page. Independent tools such as Revoke.cash cover many chains at once.
2. Paste your wallet address (read-only, no connection needed) to list every token and NFT approval, the spender contract, the amount and when it was granted.
3. Look for unlimited amounts, spenders you do not recognise, apps you have stopped using, and anything granted around the time you interacted with an unfamiliar site.

How to revoke one

Revoking means sending a new approval that sets the allowance back to zero. In an approval checker you connect your wallet and press revoke next to each entry; your wallet shows a transaction, you confirm it, and you pay a small network fee.

• Only connect your wallet to the checker you navigated to yourself, never one linked from a message, an ad or a reply.
• A revocation is a normal transaction: check that it calls approve with an amount of zero (or setApprovalForAll with false) on the token you expect.
• If your wallet is already compromised (the seed phrase leaked), revoking does not help: the attacker can sign new approvals. Move remaining funds to a fresh wallet instead.

Habits that keep the list short

• Approve the exact amount when the app allows you to edit it, especially for tokens you hold in size.
• Keep a separate wallet for trying new apps and mints, holding only what that session needs.
• Review approvals every few months, and after any interaction you were unsure about.
• Read signature requests. If a site asks you to sign something you do not understand, close it.

How this relates to the token itself

Approvals are about your wallet. The token's own contract can carry separate risks — an owner who can pause transfers or blacklist addresses, or mint new supply. Each FraudCoins coin page lists the contract permissions we can verify statically, and our five-minute vetting guide covers the rest.