Every time you’ve clicked “Approve” in MetaMask, you gave a smart contract permanent access to your tokens — unless you revoke it. Most people never do. Understanding how to revoke token approvals is one of the simplest security steps in crypto, and one of the most overlooked. This post walks you through what approvals are, why the unlimited ones are dangerous, and how to clean them up today using free tools.
What Token Approvals Actually Are
When you use a decentralized exchange like Uniswap to swap USDC for ETH, the exchange can’t just reach into your wallet and take your USDC. Ethereum doesn’t work that way. First, you sign an “approval” transaction — a separate on-chain permission that tells the USDC contract: “This address (Uniswap’s router) is allowed to move my USDC.”
Without this step, DeFi doesn’t function. Smart contracts need your explicit authorization before they can transfer tokens on your behalf. That’s a reasonable design. The problem is what happens after.
There are two kinds of approvals:
- Limited approvals — you authorize the protocol to spend only a specific amount. Once it moves that amount, the permission is exhausted. Safer.
- Unlimited approvals — you authorize the protocol to spend as many tokens as it wants, forever. Most DeFi apps request this by default because it saves users the gas cost of re-approving. Convenient, but risky.
The approval persists on-chain indefinitely. It doesn’t expire when you stop using the protocol. If you approved Uniswap three years ago and still hold USDC in that wallet, that approval is still active. If you’ve been using DEXes and DeFi apps — especially if you’ve done token swaps as covered in Post 37 on token swaps — you almost certainly have dozens of these sitting in your wallet right now.
Why Unlimited Token Approvals Are a Serious Security Risk
Token approval security becomes critical the moment something goes wrong with a protocol you’ve approved. And things go wrong constantly in DeFi.
Here’s the attack scenario: A DeFi protocol gets exploited. The attacker finds a vulnerability and drains the protocol’s liquidity. But they don’t stop there — because thousands of wallets have unlimited approvals to that contract, the attacker can also drain every wallet that ever approved it, up to each wallet’s full token balance. The users didn’t need to be logged in. The permission was just sitting there.
This has happened repeatedly across DeFi. Protocols that seemed solid at the time were later exploited, and the blast radius extended to every wallet with an outstanding approval. As we covered in our guide to DeFi wallet security (Post 47), it’s the equivalent of leaving your house key with everyone you’ve ever met — just in case.
The specific risks:
- A protocol exploit can drain your entire token balance, not just what you deposited
- Some protocols can upgrade their contracts, potentially changing what that approval authorizes
- Dormant approvals from protocols you stopped using years ago remain active until revoked
- Phishing attacks can exploit existing approval paths to drain your wallet without a new transaction from you
Unlimited token approvals were also one of the red flags we flagged when covering how to audit a DeFi protocol (Post 49). The same logic applies to your own wallet cleanup.
How to See All Your Active Token Approvals
Before you can revoke crypto permissions, you need to see what you’ve granted. Two free tools make this straightforward.
Revoke.cash (recommended): Go to revoke.cash and connect your wallet. You’ll immediately see every active token approval across every chain your wallet has used. The interface shows which token you approved, which contract has permission, whether it’s unlimited or limited, and the current value of tokens at risk. Sort by chain (Ethereum mainnet, Arbitrum, Base, Optimism, Polygon) and by approval age or token value. Most users with a year or more of DeFi activity find 30–60 active approvals, many from protocols they barely remember.
Etherscan Token Approvals Checker: Search your wallet address on etherscan.io, then navigate to the “Token Approvals” tab. This covers Ethereum mainnet only, but it’s a useful second check if you want to verify the raw on-chain data.
How to Revoke Token Approvals Step by Step (Revoke.cash Walkthrough)
This Revoke.cash tutorial takes about 15 minutes for a thorough cleanup.
Step 1: Connect your wallet. Go to revoke.cash and click “Connect Wallet.” Approve the connection in MetaMask. Note: this only allows Revoke.cash to read your approval data — it cannot move your tokens. Viewing approvals costs nothing.
Step 2: Start with Ethereum mainnet. This is where approvals are most expensive to leave active, since ETH has the highest token values.
Step 3: Sort by risk. Sort by “Value at Risk” (highest first) or by “Approval Type” to surface unlimited approvals. Unlimited approvals on your largest token balances are your highest-priority targets.
Step 4: Identify what to revoke. Revoke anything from protocols you no longer use. Revoke unlimited approvals from protocols you use infrequently. Keep approvals for protocols you interact with weekly — but note which ones are unlimited and consider whether they need to be.
Step 5: Click Revoke and confirm. For each approval, click “Revoke” and confirm the transaction in MetaMask. Revoking an approval is a real on-chain transaction — it costs gas. On Ethereum mainnet, expect $0.50–$5 per revocation depending on network congestion. On Layer 2 networks like Arbitrum or Base, the same revocation costs $0.01–$0.10. If you have many mainnet approvals, batch the work during low-gas periods.
Step 6: Repeat for other chains. Switch to Arbitrum, Base, Optimism, Polygon, and any other networks you’ve used. Each chain has its own separate set of approvals.
Making Token Approval Security a Habit
Revoking your old approvals once is good. Making it routine is better.
- After any one-time interaction — if you used a protocol once to test it or claim an airdrop, revoke the approval immediately. There’s no reason to leave it.
- When approving new protocols — check if the request is for unlimited or a specific amount. Uniswap and other modern interfaces now let you choose. Pick exact-amount whenever possible.
- Monthly audit — set a calendar reminder for the first of each month. Spend 10 minutes on Revoke.cash, check each chain, revoke anything from protocols you’ve moved on from. Same concept as reviewing bank subscriptions — except the stakes are higher.
The goal isn’t zero approvals — that would mean you couldn’t use DeFi. The goal is only the approvals you actually need, with the minimum permissions required, and no dormant permissions from two years ago.
Now you know how to revoke token approvals. The next step is actually doing it. Open revoke.cash right now, connect your wallet, and see what’s there. If you find more than ten active approvals, revoke at least three today — start with unlimited approvals on your largest balances. Then set a monthly reminder to keep it clean.
Fifteen minutes of maintenance. Potentially your entire token balance protected.
Want a complete framework for wallet security? Follow the 90-Day Wallet Security Progression — a structured approach that covers hardware wallets, DeFi due diligence, and ongoing security habits like approval management all in one place.