Revoke Token Approvals: How to Revoke Permissions and Why It Matters

Revoking token approvals is something worth doing as regularly as checking your balance if you participate in airdrops. Every swap, stake and deposit leaves a permission behind: a contract's right to move your tokens. These permissions do not expire on their own. To revoke token approvals is to close the channels through which funds can leave without a new signature from you, and this article explains how they arise, how to see them, and when revoking will not help.

This describes the mechanics of approvals on EVM-compatible networks and general tools for auditing them. It is not an exhaustive security guide and not financial advice: revoking reduces risk but does not eliminate it entirely.

What a token approval is

ERC-20 tokens (and NFTs under ERC-721/1155) cannot be «taken» by a contract on their own. For a DEX to swap your USDC, or a pool to accept your liquidity, you first have to allow the contract to pull tokens from your address — that is an approval. Technically it is an approve(spender, amount) transaction that records in the token contract: the spender address may withdraw up to amount units.

The problem lies in two properties. First, interfaces request an unlimited amount (max uint256) by default, so they do not have to ask for permission on every operation. Second, an approval is open-ended: it lives until you overwrite it. A year after you used a protocol once, its contract still has the right to withdraw your entire balance of that token.

Separately, there are permit and permit2 signatures: the approval is granted by an off-chain signature, with no transaction, and appears on-chain only when the spender uses it. This is more convenient and cheaper, but even less visible.

How an approval turns into a drain

There are several scenarios, and not all involve fraud:

A phishing site. You signed an approve to a drainer contract thinking it was a claim or a mint. The drainer calls transferFrom and takes everything it was approved for. What such sites look like is covered in the article on spotting fake claim sites.
A vulnerability in a legitimate contract. A protocol you used gets exploited. The attacker gains the ability to call transferFrom on the contract's behalf — and withdraws from everyone who left an unlimited approval. This has happened to major protocols more than once.
An upgradeable contract. A proxy contract whose logic can be replaced. If the team, or whoever obtains the keys, swaps the implementation, the old approval keeps working for the new code.
An abandoned protocol. The project shut down, the domain expired, the admin keys are lying around somewhere. The approval is still active.

What all cases share: the withdrawal happens without a new signature from you. You will not see a prompt in the wallet — only an outgoing transaction in the history.

How to view and revoke approvals

Approvals are stored in token contracts, so the wallet usually does not display them. External tools are needed:

Approval audit services. For example, revoke.cash: connect your wallet or simply enter an address, and the service lists all active approvals across networks — token, spender, amount, date granted. Revoking is an approve(spender, 0) transaction that the service builds for you. Such services exist beyond EVM networks too; the principle is the same.
Block explorers. Most explorers have a «Token Approvals» section (Approval Checker) that does the same thing without a third-party site.
Manually. Call approve with a zero amount on the token contract through the explorer's interface. Slower, but requires trusting no front end.

What matters when revoking: it is a transaction, it costs gas, and it must be done on the network where the approval was granted. Revoking permit signatures that have not yet been used works differently: you either invalidate the nonce or revoke the approval on the permit2 contract itself — audit services usually show this too. And first make sure the service you are revoking through is the real one: fake «revoke sites» exist and request exactly the signature you are trying to get rid of.

A revocation routine between campaigns

Revoking is not a one-time action after an incident but a habit. A sensible schedule:

After a campaign ends. The project moved to Distributed, you collected the tokens — revoke approvals on its contracts and on everything you connected for its checklist.
After a claim. The claim site may have requested approvals that were not needed to receive the tokens. Check right away.
Every few weeks. A general audit across every network where the wallet is active. Pay special attention to unlimited approvals and spender addresses you do not recognize.
Before a large transfer to the wallet. If you are about to hold more than usual on an address, first make sure it has no active approvals.

Prevention is cheaper than revocation: when granting an approval, set the exact amount instead of unlimited if the wallet interface allows it, and keep on the active wallet only what current actions require. How that architecture works is covered in the article on wallet setup for airdrops.

What revoking does not fix

Revoking approvals closes one specific vector — withdrawal via approve/permit. It does not help in situations that get confused with it:

A leaked seed phrase or private key. Whoever holds the seed is a full owner of the wallet. They can grant new approvals, transfer funds directly, and undo your revocations. The only solution is a new wallet with a new seed and moving whatever is left.
A transfer that already went through. If transferFrom has already executed, revoking protects only the remainder. What left does not come back.
The network's native token. ETH, BNB and their equivalents do not require approve. They can be lost only through a direct transaction you signed yourself — revoking is irrelevant here.
Account delegation. On networks where an account can delegate code execution to another contract, revoking token approvals does not cancel the delegation. That is a separate setting.
Scam tokens in the wallet. Tokens that «arrived» on their own are harmless until you interact with them. There is nothing to revoke; just do not touch them and do not follow links in their names.

Bottom line: revoking approvals is a required but not sufficient part of hygiene. Combined with a separate wallet, link verification and reading what you sign, it makes airdrop participation an activity with limited risk. The project statuses after which an audit makes sense — Reward available and Distributed — are tracked on CoinDropster. See tracked airdrops →