When interacting with DeFi protocols, DEX exchanges, or NFT marketplaces, you frequently need to "approve" smart contracts to use your tokens. Many users click approve and then forget about it, unaware that these approvals may persist indefinitely and pose hidden risks to their assets. This article teaches you how to check, manage, and revoke unnecessary token approvals.
What Is Token Approval?
Token approval is the approve function in the ERC-20 standard, which allows you to authorize a specific smart contract to transfer a specified amount of your tokens on your behalf. For example, when you swap tokens on Uniswap, you first need to approve Uniswap's router contract to use your tokens before it can complete the swap.
How the approval workflow works:
- You initiate a transaction on a DApp (e.g., token swap)
- The DApp requests approval to use a specific token of yours
- You confirm the approval transaction in your wallet
- Once approved, the DApp's contract can transfer your tokens within the approved limit
- Subsequent transactions do not require re-approval
The problem is that many DApps request "Unlimited Approval" by default, meaning the contract can transfer the entire balance of that token in your wallet, and this approval has no expiration date.
Why Is Unlimited Approval Dangerous?
Once you give a contract unlimited approval, even if you later stop using that DApp, the approval remains active. If the contract has a vulnerability or is exploited by hackers, your tokens could be transferred out without your knowledge.
Historical security incidents caused by approvals:
- Multiple DeFi protocols were exploited through contract vulnerabilities, directly transferring users' approved tokens
- Fake DApps tricked users into approving and then directly stole assets
- Malicious contracts obtained approvals by disguising as normal functionality
How to Check Your Current Approval Status?
Several tools can help you view all existing approvals in your wallet:
Revoke.cash
- Visit the revoke.cash website
- Connect your wallet or enter your wallet address
- Select the corresponding blockchain network
- View the list of all active token approvals
- You can revoke unnecessary approvals directly on the page
Etherscan Token Approval
- Visit etherscan.io
- Find "Token Approvals" under the "More" menu
- Connect your wallet to view the approval list
- Supports revocation operations
DeBank
- Visit debank.com
- Enter your wallet address
- Check all approvals under the "Approval" tab
- Supports viewing approvals across multiple chains
It is recommended to use multiple tools for cross-verification to ensure nothing is missed.
How to Revoke Unnecessary Approvals?
Revoking an approval is straightforward but requires paying Gas fees:
- Open Revoke.cash or a similar tool
- Connect your wallet
- Find the approval to revoke
- Click the "Revoke" button
- Confirm the transaction in the wallet popup
- Pay the Gas fee to complete the revocation
Revocation is essentially an on-chain transaction that sets the approval amount to zero. Each revocation requires a separate Gas fee, and if you have many approvals to revoke, the total Gas cost can add up.
Gas-saving strategies:
- Operate during low-Gas periods (typically weekends or late at night)
- Prioritize revoking approvals for high-value tokens and suspicious contracts
- For low-Gas chains like BSC and Polygon, you can revoke everything
How to Reduce Risk When Granting Approvals?
Prevention is more important than after-the-fact revocation. Here is what to keep in mind when granting approvals:
- Set custom approval amounts: In the MetaMask popup, click "Edit" to change unlimited approval to only the amount you actually need
- Only approve trusted protocols: Well-known DeFi protocols like Uniswap and Aave are relatively safe
- Revoke after use: Revoke the approval promptly after you are done with a DApp
- Regularly clean up approvals: Check your approval list monthly and revoke ones you no longer use
- Use separate addresses for interactions: Use a separate wallet address for high-risk DApps — do not use the address that holds large amounts of assets
Security Reminder
Token approval management is an important component of wallet security. The following habits can help reduce your risk:
- Never approve on untrusted DApps: Unknown projects may be designed specifically to steal approvals
- Read approval requests carefully: Pay attention to the token type and approval amount — reject any abnormal requests immediately
- Regularly review your approval list: At least once a month, clean up approvals that are no longer needed
- Monitor security announcements: If a protocol you approved has a security incident, revoke the approval immediately
- Use wallets with approval management features: Some wallets have built-in approval viewing and management capabilities
- Do not expose large assets to high-risk DApps: Use a small, separate wallet for experiments and interactions
Want to manage your crypto assets more securely? Consider storing large assets on an exchange to benefit from the platform's security mechanisms. Visit Binance to start secure trading, or download Binance App (Apple users refer to the iOS installation guide) for anytime management.
Can I Still Use the DApp After Revoking an Approval?
Yes. Revoking an approval only removes the contract's permission to transfer your tokens. The next time you use that DApp, you simply need to re-approve. For trusted DApps you use frequently, you can keep the approval active.
How Much Gas Does Revoking an Approval Cost?
Revoking one approval on Ethereum typically costs 0.001–0.005 ETH (depending on network congestion). On BSC, it costs approximately 0.0001–0.0005 BNB. On Polygon, it is nearly free.
Do NFT Approvals Also Need to Be Revoked?
Yes. NFT marketplaces (like OpenSea) also request approvals, and they typically use setApprovalForAll (approval for all NFTs). If you no longer use a particular NFT marketplace, it is recommended to revoke its approval to prevent unauthorized NFT transfers.
Do Approval Records Expire?
No. On-chain approvals have no expiration mechanism — once granted, they remain permanently valid until you manually revoke them. This is why regularly cleaning up approvals is so important.