Revoke Token Approvals: The Cleanup Step Most Wallets Never Prompt You For
Every token approval you've ever granted stays active until you cancel it — including ones from contracts you forgot existed. Here's what that risk actually is and how to check.
Most crypto users check their token balances regularly. Almost nobody checks their approvals — the list of contracts they've given permission to spend specific tokens on their behalf. That list only grows, and nothing prompts you to clean it up.
What a token approval actually is
On EVM chains, before a contract (a DEX, a staking protocol, an NFT marketplace) can move a token out of your wallet, you have to explicitly approve it first — a separate signed transaction from the swap or stake itself. Most interfaces default to requesting an unlimited approval, not just the amount for that one transaction, because it saves you from re-approving every time you use that app again.
That convenience is also the risk: the approval doesn't expire when the transaction finishes. It sits there, active, indefinitely, until you manually revoke it.
Why an old approval you forgot about is a real risk
Say you tried a new DeFi protocol a year ago, swapped once, and never went back. If that protocol's contract is exploited later — or turns out to have been a slow-rug from the start — your still-active approval means the attacker's contract can pull that token straight out of your wallet, with no new signature required from you. You don't have to be using the app when the exploit happens. You just have to have an approval sitting there from when you last did.
This is a genuinely common attack pattern: it's not phishing you directly, it's exploiting permission you already granted and forgot about.
How to actually check and clean this up
- Etherscan's Token Approval Checker (and the equivalent block explorers for other EVM chains) lists every active approval tied to your address, which contract holds it, and lets you revoke each one with a signed transaction — no cost beyond gas.
- Wallet-native approval managers — MetaMask and several other wallets now surface this directly in their settings, without needing a third-party site.
- A practical habit: review this every few months, not just after a hack headline. Revoke anything tied to an app you no longer use, especially unlimited approvals on tokens you hold meaningful value in.
Where prevention fits in
Revoking cleans up permissions you've already granted. The complementary move is granting fewer risky ones in the first place — Burner Shield checks a contract's real risk profile (honeypot behavior, malicious-address flags, mint/tax risk) before you approve anything, using GoPlus Security's public data. Prevention and cleanup are two different steps; neither replaces the other.
Check a contract before you approve it — and if it's been a while, go check what's still approved on your wallet too.