How to Revoke Token Approvals on Ethereum and Other EVM Chains
Learn how to revoke approvals on Ethereum and other EVM chains step by step, which approvals are risky, what revoking costs and what it cannot undo.
To revoke token approvals on Ethereum or another EVM chain, connect your wallet to a trusted approval checker (such as Revoke.cash or a block explorer's token approval tool), select the network, review which contracts can spend your tokens, and submit a revoke transaction for any you no longer use or do not recognize. Each revoke is an on-chain transaction that sets the allowance to zero and costs a small gas fee.
Approvals are one of the most overlooked risks in self-custody. Every time you trade on a decentralized exchange or use a DeFi app, you probably grant a contract permission to move your tokens. Those permissions stay active indefinitely. If that contract is later exploited, or if you approved a malicious one, your tokens can be taken without any further signature from you.
How Token Approvals Work
ERC-20 tokens, the standard for most tokens on Ethereum, include an approve function. When you approve a contract, you set an allowance: the maximum amount of that token the contract may transfer from your address.
Many apps request an unlimited allowance so you do not have to approve again for every trade. That is convenient, but it means the contract can move your entire balance of that token at any time, now or in the future.
NFTs work similarly. The setApprovalForAll function gives an operator permission to move every NFT in a collection you own, which is why NFT drainers target it.
There is also a newer pattern: permit signatures. Some tokens and systems (including Uniswap's Permit2) let you grant an allowance by signing an off-chain message instead of sending a transaction. These signatures look harmless but can authorize transfers. Our article on ice phishing and permit signatures covers this risk.
Step-by-Step: How to Revoke Approvals
- 1Open a trusted tool directly. Type the address yourself or use a bookmark. Well-known options include Revoke.cash and the token approval checker on Etherscan and other explorers. Fake "revoke" sites exist, so never follow links from DMs or ads.
- 2Connect your wallet or paste your address. Pasting an address lets you view approvals without connecting. You only need to connect to submit revoke transactions.
- 3Choose the network. Approvals are per chain. Check Ethereum, then each network you use, such as Arbitrum, Optimism, Base, Polygon or BNB Smart Chain.
- 4Review the list. For each approval you will see the token, the spender contract, the allowance amount and often when it was granted.
- 5Identify what to revoke. Prioritize unlimited allowances, spenders you do not recognize, apps you no longer use and any contract involved in a known exploit.
- 6Click revoke and confirm in your wallet. Read the wallet prompt: it should be an
approvecall setting the allowance to zero (or asetApprovalForAllcall set to false for NFTs). - 7Repeat for each network. Then refresh to confirm the approvals are gone.
Which Approvals to Revoke First
| Approval type | Risk level | Action |
|---|---|---|
| Unlimited allowance to unknown contract | High | Revoke immediately |
setApprovalForAll on a valuable NFT collection | High | Revoke unless actively listing |
| Unlimited allowance to an app you no longer use | Medium | Revoke |
| Limited allowance to a reputable app you use often | Low | Keep or reduce |
| Approval to a contract involved in an exploit | High | Revoke immediately |
What Revoking Cannot Do
Revoking is preventive, not a cure. It will not:
- Return tokens that have already been transferred.
- Protect you if your seed phrase or private key has been stolen. In that case, the attacker can sign anything; move remaining assets to a new wallet as described in what to do immediately if your wallet is compromised.
- Reliably cancel off-chain permit signatures you have already given. These follow their own expiry and nonce rules, so if you signed a suspicious permit, the safest response is to move the affected tokens to a fresh wallet.
Reduce Approval Risk Going Forward
- Set custom allowances. Many wallets let you edit the amount in the approval prompt. Approve only what you plan to spend.
- Use a separate wallet for experiments. Keep a burner wallet for new apps, mints and airdrops, and keep long-term funds in a wallet that never connects to unfamiliar sites.
- Read every signature request. If a site asks you to sign a message you do not understand, stop.
- Review approvals regularly. Every few months, and after trying any new app.
- Check connected sites too. Connection and approval are different; see wallet permissions and connected sites.
Common Mistakes
- Using a fake revoke tool found through a search ad or a reply on social media.
- Revoking on Ethereum but forgetting the same wallet on layer-2 networks.
- Assuming disconnecting a site in your wallet removes its approvals. It does not.
- Ignoring small-value tokens; attackers often sweep everything they can.
Bottom line
Token approvals are standing permissions that outlive the moment you granted them. Checking them is free, revoking them is cheap, and doing it regularly closes one of the most common paths drainers use. Make it part of your routine, approve only what you need, and keep your main holdings in a wallet that rarely signs anything.
Frequently asked questions
What is a token approval?
A token approval is permission you give a smart contract to move a specific token from your wallet, up to a set amount. Decentralized exchanges and other DeFi apps need approvals to work. The permission stays active until you revoke it or the allowance is used up, even if you never visit the app again.
Does revoking an approval cost gas?
Yes. Revoking is an on-chain transaction that sets the allowance to zero, so you pay a normal network fee. On Ethereum mainnet this can be noticeable; on layer-2 networks it is usually cheap. Viewing your approvals is free.
Will revoking an approval get my stolen tokens back?
No. Revoking only prevents future transfers by that contract. Tokens that have already been taken cannot be recovered by revoking. If your seed phrase or private key was exposed, revoking is not enough; move remaining funds to a new wallet.
How often should I check my token approvals?
A good habit is to review them every few months and after any session where you interacted with a new or unfamiliar app. Also check immediately if you suspect you signed something malicious.