How to check and revoke token approvals safely

Introduction

Learning how to check and revoke token approvals is an important wallet-security task for anyone who uses decentralized applications, often called dapps.

This guide explains what token approvals do, why old or unlimited permissions can be risky, and how to review and remove unwanted approvals without relying on a particular wallet interface.

What Are Cryptocurrency Token Approvals?

A token approval gives a dapp or smart contract permission to access and move specified tokens in a wallet. The approval may remain active after the original interaction with the application has ended.

Revoking an approval removes that permission. This is different from disconnecting the wallet from a website or application, because disconnecting alone does not cancel an existing on-chain token approval.

Why Checking Token Approvals Matters

Introduce token approvals as persistent permission links between wallet assets and smart contracts, with revocation shown as removing that link rather than moving the assets.

Active approvals can matter long after a dapp interaction. An unlimited approval can create ongoing exposure because the approved contract has permission to move the relevant tokens without being limited to a smaller allowance.

If an approved contract is malicious, hackers or fraudulent contract owners may be able to continue draining approved tokens after an initial scam. Ethereum.org therefore advises users to check active approvals and revoke permissions they do not want.

Regular reviews can make unwanted access easier to identify. The MetaMask Help Center recommends checking approvals regularly, giving monthly reviews as an example.

What to Check Before You Start

Show the essential preparation checks: correct wallet, correct supported network, sufficient gas, and protection of wallet secrets.

Identify the correct wallet. Confirm the public wallet address whose approvals you intend to review.
Identify the blockchain network. Approvals are associated with a particular network, so reviewing one network does not show approvals on every other network.
Choose a supported method. Confirm that the approval checker or block explorer supports the relevant network before using it.
Prepare for gas costs. Revocations are on-chain transactions, and each revocation requires a transaction fee paid with the network’s gas asset.
Protect wallet credentials. Never disclose a private key, seed or recovery phrase, password, or authentication code to an approval-checking service or anyone claiming to help with a revocation.

Do not proceed until the wallet address, network, checking method, and available gas asset have all been confirmed.

How to Check and Revoke Token Approvals Step by Step

Demonstrate the central revocation action: identify an unwanted permission, verify its relationship, and remove the approval link using a generic educational representation.

Choose an approval-checking method. Supported examples include MetaMask Portfolio for Ethereum Mainnet, Polygon, and BNB Chain; network explorers such as Etherscan, BscScan, and Polygonscan; and approval services identified by the verified sources, including Revoke.cash, Unrekt, approved.zone, beefy.finance, EverRevoke, and Revokescout via Blockscout. Tool and network support can change, so confirm current support before connecting a wallet or submitting a transaction.
Select the correct network. Make sure the checker is displaying the blockchain network on which the approval was granted.
Connect or look up the correct wallet. Depending on the supported method, connect the intended wallet or look up its public address. Never enter a private key or recovery phrase.
Inspect the active permissions. Review the tokens, approved spenders, and allowance information presented by the checker. Pay particular attention to unlimited permissions and approvals associated with applications you no longer use.
Identify approvals you no longer want. Select only permissions you recognize as unnecessary or unwanted. Do not revoke an item merely because its name is unfamiliar; first review the available token and spender information.
Verify the token and spender contract details. Confirm that the approval relates to the intended token and spender contract before creating a revocation transaction.
Submit the revocation. Use the selected checker’s revocation function to prepare the on-chain transaction. Interface wording varies, so rely on the transaction details rather than assuming a particular menu name.
Review the wallet transaction request. Check the wallet address, network, token, spender contract, and transaction information before signing. Reject the request if the information does not match what you intended to revoke.
Pay the required gas. Each revocation is an on-chain transaction and requires the relevant network’s gas asset.
Wait for on-chain processing. Do not assume the permission has been removed merely because the request was submitted.
Confirm the result. Check the approval again after processing to confirm that the unwanted permission has been removed.

Repeat the review carefully for other unwanted approvals, remembering that separate revocations are submitted as separate on-chain transactions.

Important Security Cautions and Limitations

Disconnecting is not revoking. Disconnecting a wallet from a dapp does not remove an existing token approval. Check the on-chain permission separately and revoke it if it is no longer wanted.
Unlimited approvals create continuing exposure. An unlimited permission may allow an approved contract to keep accessing the relevant tokens. Review such permissions carefully and remove unwanted access.
Malicious permissions can remain dangerous. A malicious contract may continue moving approved tokens after an initial scam. Review active approvals promptly if you suspect a harmful interaction.
Revocations require on-chain transactions. A revocation is not a free account setting. Each one must be submitted as a transaction and requires gas.
Support varies by tool and network. A checker that supports one blockchain may not support another. Verify network support rather than assuming that a single view covers every network.
Transaction details require careful review. Before signing, verify the network, wallet address, token, spender contract, and other transaction information displayed by the wallet.
Wallet secrets must remain private. Never share private keys, seed or recovery phrases, passwords, or authentication codes when checking or revoking approvals.

If any network, contract, or transaction detail is unclear, stop before signing and verify the information through a trusted method.

Common Token Approval Mistakes to Avoid

Clarify the critical mistake that disconnecting a wallet does not revoke an existing approval, especially when a broad permission pathway remains active.

Assuming that disconnecting cancels approvals. Treat disconnection and on-chain revocation as separate actions.
Checking the wrong wallet. Compare the displayed public wallet address with the address you intended to review.
Checking the wrong network. Select the blockchain on which the approval was originally granted.
Overlooking unlimited permissions. Inspect allowance information instead of reviewing only the application or token name.
Revoking without checking the details. Verify the token and spender contract before submitting the transaction.
Forgetting about gas. Hold enough of the relevant network’s gas asset to submit each intended revocation.
Revealing wallet secrets to a service. An approval review is never a reason to disclose a private key, recovery phrase, password, or authentication code.

A deliberate review of the wallet, network, approval details, and transaction request helps prevent these common errors.

Frequently Asked Questions

Does disconnecting a dapp revoke its token approvals?

No. Disconnecting a wallet from a dapp does not remove existing token permissions. Revocation is a separate on-chain action.

Does revoking an approval cost gas?

Yes. Revocations occur on-chain, so each revocation transaction requires gas paid with the relevant network’s gas asset.

Does each approval need its own on-chain transaction?

Each revocation is submitted as an on-chain transaction and requires gas. Review the transaction request for every permission you choose to remove.

How often should approvals be reviewed?

MetaMask recommends checking approvals regularly and provides monthly reviews as an example. A review may also be useful after an interaction you suspect was malicious.

What types of tools can check approvals?

Verified options include supported wallet portfolio tools, network block explorers, and dedicated approval services. Examples identified by the sources include MetaMask Portfolio, Etherscan, BscScan, Polygonscan, Revoke.cash, Revokescout via Blockscout, Unrekt, approved.zone, beefy.finance, and EverRevoke. Confirm that a selected option supports the relevant network.

Does revoking an approval move the tokens?

The purpose of revocation is to remove the spender’s permission to access and move the approved tokens. It is a permission change rather than an instruction to transfer those tokens to another address.

Key Takeaway

Provide a calm final review showing that the revocation has settled on-chain, the permission is removed, gas was required, and the wallet assets remain in place.

Review approvals using the correct wallet address and blockchain network, identify permissions that are no longer wanted, and verify the token, spender contract, and transaction details before signing. Account for gas because every revocation is an on-chain transaction, and confirm afterward that the permission has been removed.

Remember that disconnecting a dapp is not the same as revoking its approval, and never disclose private keys, seed or recovery phrases, passwords, or authentication codes while completing this process.

Educational Disclaimer

This article is for general educational and informational purposes only and does not constitute investment, financial, legal, or tax advice.

Any AI-generated images included with this article are educational visual aids and should not be interpreted as official project interfaces, products, technical diagrams, or exact real-world representations. Separately supplied verified project icons or identity assets are distinct from AI-generated educational images.