How to Revoke Token Spending Allowances

A token allowance is permission your wallet gives a smart contract to spend up to a certain amount of a specific token on your behalf. You grant one whenever you swap on a DEX or deposit into a lending protocol. To revoke it, open a tool such as Revoke.cash, Etherscan’s Token Approval Checker or your wallet’s built-in permissions screen, find the approval and sign a transaction that sets it to zero.

Revoking matters because an allowance stays active until you cancel it. If the contract is later exploited, or if you gave the approval to a phishing site, your tokens can be taken without any further confirmation from you.

How do token allowances work?

ERC-20 tokens on Ethereum and compatible networks are designed so that contracts can’t simply take your tokens. Before using an app, you therefore make two transactions: an “approve” transaction granting the contract a spending allowance, followed by the actual swap or deposit. Every allowance has three parts: the token, the spender contract and the approved amount.

For convenience, many apps request an unlimited allowance by default. That saves you approving again each time, but it lets that contract spend every unit of that token in your wallet. NFTs have an equivalent called “setApprovalForAll,” which covers every NFT you own in a collection.

Why disconnecting your wallet isn’t enough

Disconnecting a site in your wallet only stops it from seeing your address and proposing new transactions. The allowance itself is recorded on-chain, in the token contract. It stays valid even if you disconnect, delete the browser extension or move your wallet to another device. The only way to remove it is an on-chain transaction that sets it to zero.

How to revoke token approvals, step by step

1. Pick the network and address. Allowances are per network. Revoking on Ethereum does nothing for approvals on Arbitrum or BNB Smart Chain, so check each network you’ve used.
2. Open a trusted approval tool. Revoke.cash and block explorer approval checkers (Token Approval Checker on Etherscan) are common choices, and some wallets, such as Rabby, include their own approvals screen. Type the address directly to avoid fake copies in search ads.
3. Review the list. Each row shows the token, the spender contract, the approved amount and when it was granted. Unknown contracts, unlimited approvals and apps you no longer use are the first to go.
4. Revoke. Clicking “Revoke” prompts your wallet to sign a transaction that sets the allowance to zero. Check on the wallet screen that it really is an approval with an amount of 0.
5. Budget for gas. Every revoke is a separate transaction with its own fee. On Ethereum mainnet, revoking dozens of approvals can add up, so prioritize valuable tokens and risky spenders.

If you still use the app, some tools let you reduce the allowance to just what you need instead of removing it entirely.

Will the app stop working if I revoke?

The app keeps working; it will simply ask for a new approval next time, which means one extra signature and a small fee. Leaving a sensible allowance in place for a trusted app you use often can be practical. Revoking approvals for apps you tried once or rarely use cuts your exposure directly.

What are permit and Permit2 signatures?

Some tokens support the “permit” feature defined in ERC-2612, which grants an allowance through a free, off-chain message signature instead of an on-chain transaction. Uniswap’s Permit2 contract works in a similar way, creating signature-based allowances that can expire.

Because no gas is paid, these signatures feel harmless, but their effect is the same as a regular approval. That’s exactly why phishing sites love them. Before signing, read the token, spender, amount and expiry your wallet shows.

Is revoking enough if my private key leaked?

No. Revoking only stops specific contracts from spending your tokens. If your recovery phrase or private key has been exposed, the attacker controls the wallet itself and can transfer tokens directly. The fix is to create a new wallet and move your assets there immediately. Our phishing protection guide walks through the steps.

When should you check your approvals?

• Right after connecting to and signing on an unfamiliar site.
• When you hear that a protocol you’ve used has been exploited.
• When you stop using an app.
• Otherwise, every few months if you’re an active DeFi user.

Keeping the wallet you connect to apps separate from the one holding your long-term savings also limits the damage from the start; our hot vs cold wallets guide explains how to set that up. For what the approval step looks like during a trade, see our guide on how to swap on a DEX.

Unlimited or limited approval?

Many wallets let you edit the amount when an approval request comes in. A hypothetical example: you’re swapping 100 USDC on a DEX and the app asks for an unlimited approval. If you cap it at 100 USDC, the remaining allowance drops to zero once the swap completes. Even if the contract is exploited later, the rest of your USDC is untouched.

The cost of limited approvals is approving again, and paying a small fee, each time. A practical balance: leave a reasonable allowance for large, long-running protocols you use regularly, and approve only the exact amount for new, unfamiliar or one-off apps.

Frequently asked questions

Does revoking an approval get my tokens back?

No. Revoking only prevents future spending. Tokens that were already taken don’t come back.

Do Solana and Bitcoin have token approvals?

The approve model in this guide is specific to Ethereum and EVM-compatible networks. Solana token accounts have a similar “delegate” authority that some wallets let you manage, while Bitcoin has no equivalent spending allowance.

Sources

• ERC-20: Approve and allowance
• ERC-2612: Permit via signature
• Ethereum: Token permissions and security