Revoking token approvals cancels the permission you gave a smart contract to spend your tokens. Open Revoke.cash, connect your wallet, select your network, identify unlimited or unfamiliar approvals, and click Revoke next to each one. Each revocation is a small on-chain transaction costing under Rs 50 on most Layer 2 networks.
- Key Takeaway 1: Every time you interact with a DeFi protocol or swap on a DEX, you sign an approval that can stay active forever unless you cancel it.
- Key Takeaway 2: Unlimited approvals let a contract drain your entire token balance at any time, even months after you last used the app.
- Key Takeaway 3: Tools like Revoke.cash, Etherscan’s Approval Checker, and De.fi Shield let you audit and revoke token approvals in a few clicks.
- Key Takeaway 4: Each revocation is an on-chain transaction, so you’ll pay a small gas fee, typically under Rs 50 on Ethereum L2s and a few rupees on BNB Chain.
- Key Takeaway 5: A monthly approval audit, combined with spotting fake airdrops early, is your best defence against wallet drainers.
How Token Approvals Work and Why They Persist
When you use a decentralised exchange like Uniswap or a yield farm, the app asks you to sign an approval transaction. This tells the smart contract: “You’re allowed to move X amount of my tokens.” Without this step, the contract can’t touch your funds at all.
The problem is that most apps historically requested unlimited approvals, meaning the contract can move every single token you own, not just the amount for that one trade. This was done to save users gas on future transactions. It’s a convenience that became a serious vulnerability.
These approvals don’t expire. If the protocol gets hacked six months later, the attacker inherits those permissions. According to the De.fi REKT Database 2023 Annual Report, wallet drainers and approval exploits accounted for over $300 million in losses in 2023. That’s not a small number.
Think of it like giving a stranger a signed blank cheque. You trusted them at the time, but the cheque sits in their drawer indefinitely. Revoking token approvals tears up that cheque. If you’ve ever clicked through a fake airdrop site, there’s a real chance a malicious approval is already sitting in your wallet right now.
How to Check and Audit Your Token Approvals
Before you can revoke token approvals, you need to see what you’ve approved. Here are the most reliable token approval checker tools available today.
Revoke.cash
Go to revoke.cash, connect your wallet (read-only mode is available, so no signing is required just to view), and select your network. The dashboard lists every active approval, the spender contract address, and whether the allowance is unlimited or a specific amount. It covers Ethereum, Polygon, BNB Chain, Arbitrum, Base, and dozens more.
Etherscan Token Approval Checker
Visit etherscan.io/tokenapprovalchecker, paste your wallet address, and connect. This works specifically for Ethereum mainnet. It’s slightly more technical but directly integrated with Etherscan’s verified contract data, which adds a layer of confidence when identifying spender contracts.
De.fi Shield
De.fi’s Shield feature combines approval scanning with a risk score for each spender contract. It flags contracts that have been flagged in audits or associated with rug pulls. This is especially useful if you’ve been experimenting with newer DeFi protocols or meme coin ecosystems where contract quality varies wildly.
| Tool | Chains Supported | Risk Scoring | Cost to Use |
|---|---|---|---|
| Revoke.cash | 100+ EVM chains | Basic | Free |
| Etherscan Checker | Ethereum only | No | Free |
| De.fi Shield | 20+ chains | Yes (audited) | Free (premium tier exists) |
| Unrekt.net | Major EVM chains | No | Free |
Revoking Token Approvals Safely: Step-by-Step Guide
Once you’ve identified dangerous or unfamiliar approvals, here’s how to revoke token approvals safely. The process is the same across most tools.
- Open Revoke.cash in your browser and connect your MetaMask, Coinbase Wallet, or WalletConnect-compatible wallet.
- Select the correct network (Ethereum, Polygon, BNB Chain, etc.). Run the audit for each chain separately if you’re active on multiple networks.
- Review the spender list. Look for contracts you don’t recognise, contracts with unlimited allowances, or protocols you no longer use. A honeypot token interaction often leaves a dangerous approval behind.
- Click Revoke next to each approval you want to cancel. Your wallet will prompt you to sign a transaction. This is safe to sign as it’s just setting the allowance to zero.
- Pay the gas fee and wait for confirmation. On Ethereum mainnet, gas can be Rs 200 to Rs 800 per revocation depending on network congestion. On Arbitrum or Polygon, it’s typically under Rs 30.
- Prioritise unlimited approvals first. If you must choose due to gas costs, cancel unlimited allowances before fixed-amount ones.
One practical tip: don’t revoke approvals for protocols you actively use daily. Revoking means you’ll need to re-approve next time, costing another gas fee. Focus on old, unused, or suspicious approvals.
What About Non-EVM Wallets?
Solana uses a different permission model called token delegates. You can audit these using Solana-specific tools like Revoke.cash’s Solana beta or Step Finance. The concept is identical even if the underlying mechanics differ.
Building a Token Approval Hygiene Routine
Revoking token approvals once isn’t enough. Every new protocol interaction creates a new approval. The goal is to make auditing a regular habit, not a panic response after something goes wrong.
Monthly Audit Habit
Set a calendar reminder for the first Sunday of each month. Connect to Revoke.cash, scan all active chains, and revoke token approvals for anything you haven’t used in 30 days. This takes about 10 minutes and costs a few hundred rupees in gas at most. It’s genuinely worth it.
Use Limited Approvals by Default
When a protocol asks for an unlimited approval, manually edit the amount to exactly what you need for that transaction. MetaMask now prompts you to customise the spending cap before signing. Use that feature every single time.
Separate Wallets for Different Risk Levels
Keep a dedicated “hot” wallet with only small amounts for DeFi experiments, meme coins, and new protocol testing. Your main holdings stay in a cold wallet or a separate address that never touches DEX contracts. This way, even a worst-case unlimited approval can only drain a limited amount. Indian investors using platforms like WazirX or CoinDCX for centralised trading aren’t exposed to this risk there, since CEX platforms manage custody, but any self-custody DeFi activity creates approvals.
Emerging AI agents in crypto are increasingly being used to automate approval audits and flag risky contracts in real time. These tools are still early-stage but worth watching as they mature.
After Any Suspicious Transaction
If you see an unexpected token movement or a transaction you don’t remember signing, run a full approval audit immediately before moving any more funds. Transfer remaining assets to a fresh wallet address if you suspect a compromise. According to the Chainalysis 2024 Crypto Crime Report, approval phishing was the fastest-growing wallet attack vector in 2023, with losses rising 374% year-on-year. Acting fast matters.
A 2024 report by blockchain analytics firm Elliptic found that phishing-linked approval exploits resulted in over $47 million in losses in Q1 2024 alone, underscoring how rapidly this attack vector is scaling. Indian investors should note that even if tokens are drained, the 30% VDA tax and 1% TDS framework under India’s Finance Act 2022 doesn’t provide relief for theft losses. You can’t offset drained tokens against gains. That alone makes prevention far more valuable than any recovery attempt.
Frequently Asked Questions
What is a token approval and why does it matter?
A token approval is a permission you grant to a smart contract, allowing it to spend a specific token from your wallet. You sign this approval transaction when using DEXes, lending platforms, or DeFi apps. The permission stays active on-chain until you explicitly revoke token approvals, regardless of whether you still use that platform.
Why are unlimited token approvals dangerous?
Unlimited approvals give a smart contract permission to move your entire token balance at any time. If that contract is later exploited, upgraded maliciously, or was a scam from the start, the attacker can drain everything in a single transaction. There’s no cap on what they can take. Limiting approvals to the exact transaction amount removes this risk entirely.
How do I check my existing token approvals?
Use Revoke.cash (supports 100+ EVM chains), Etherscan’s Token Approval Checker (Ethereum only), or De.fi Shield (includes risk scoring). Connect your wallet or paste your address in read-only mode. The tools list every active approval with the spender contract and allowance amount. Run this check on each chain where you’ve been active.
How much does revoking token approvals cost in gas fees?
Each revocation is a small on-chain transaction. On Ethereum mainnet, expect roughly Rs 200 to Rs 800 per revocation depending on gas prices. On Layer 2 networks like Arbitrum or Base, it’s typically Rs 5 to Rs 30. On BNB Chain or Polygon, costs are similar to L2s. Batching revocations during low-traffic periods (early morning UTC) saves money.
Can Indian users on WazirX, CoinDCX, or ZebPay be affected by token approval exploits?
No. If you only trade on Indian centralised exchanges like WazirX, CoinDCX, or ZebPay, you are not exposed to token approval risks because those platforms manage custody internally. Token approval exploits only affect self-custody wallets used for DeFi, DEX trading, or any on-chain interaction. If you use both a CEX and a personal wallet, audit the personal wallet regularly.
This is not financial advice. Data as of July 2025. Verify all statistics with named sources before republishing.
Last updated: July 2025. Reviewed by the CryptoWire editorial team.
