How to Check and Revoke Risky Token Approvals on Your Wallet

TL;DR - Open your wallet's token-approval list on a block explorer or an allowance checker, then send a revoke transaction setting the allowance to zero for any unlimited or unused contract.

Every time you swap, stake, or mint, your wallet signs an approval that lets a smart contract move your tokens. That permission does not expire when you close the tab. It sits on-chain until you remove it, and if the approved contract is later exploited or turns out to be malicious, it can pull the approved tokens with no further click from you. This guide shows how to see every standing approval and revoke the dangerous ones.

What is a token approval, and how can it drain your wallet?

ERC-20 tokens do not let a contract spend your balance unless you grant an allowance first. When a swap interface asks you to "approve" a token before your first trade, you are signing an allowance that names a spender contract and an amount. Most interfaces request an unlimited amount by default, so you only ever pay for one approval instead of one per trade.

The convenience is also the risk. An unlimited allowance means the spender can move your entire balance of that token at any point in the future. Wallet documentation from MetaMask spells this out plainly: a token approval often grants unlimited access, and a malicious or compromised contract holding that approval can in theory drain the token from your wallet. The approval is a standing key, and it stays valid until you cancel it.

This is why so many drainer incidents trace back to an old approval rather than a fresh signature. A user approved a contract months ago, forgot about it, and the contract was later drained through an exploit. The victim signed nothing new. The allowance they granted long ago was enough.

How do you check which contracts your wallet has approved?

Start by listing every active allowance. A block explorer such as Etherscan has a token-approval checker that, given your address, lists each token, the spender contract, and the approved amount. Dedicated allowance tools like Revoke.cash and the approval manager built into MetaMask show the same data with a one-click revoke button next to each entry. Reading the list is the goal: any entry marked unlimited, or any spender you no longer recognize, is a candidate for removal.

Checking approvals tells you what a contract can take, but not whether your wallet has already touched tainted funds. Rather than checking one source at a time, screen the address with Plastron to see sanctions, mixer, and stolen-funds exposure across Ethereum and six chains at once. Plastron does not revoke approvals for you - it shows the risk picture so you know whether a wallet that interacted with a bad contract has already inherited exposure worth documenting.

When you read the approval list, sort your priorities like this:

• Unlimited allowances to contracts you have not used in months carry the most standing risk and should go first.
• Approvals to interfaces you still use daily can stay, but consider replacing unlimited with a capped amount.
• Any spender address you cannot identify at all is the strongest signal to revoke immediately.

How do you revoke a risky token allowance?

Revoking is itself an on-chain transaction. You are calling the token's approve function again and setting the allowance for that spender to zero, which overwrites the old permission. The steps are the same whether you use an explorer, a wallet's built-in manager, or a dedicated checker:

1. Connect the wallet that holds the approvals to the approval-checker page.
2. Find the row for the token and spender you want to cut off.
3. Click revoke, which builds an approve transaction with an amount of zero.
4. Confirm in your wallet and pay the gas fee to write the change on-chain.
5. Refresh the list and confirm the allowance now reads zero.

Each revoke costs gas, because it is a real transaction, so batching several in one session when fees are low is the practical approach. Revoking on one chain only clears approvals on that chain - if you have used the same address on Arbitrum, Base, or Polygon, repeat the check on each network where the wallet has activity.

Which token approvals should you revoke first?

Not every approval is worth a gas fee to remove, so triage by exposure. The amount approved, how recently you used the spender, and whether you can identify the contract together decide the priority.

The highest-priority removals are unlimited approvals on tokens you hold in size, granted to contracts you have stopped using. A stablecoin balance sitting behind an unlimited approval to a dapp you abandoned is the exact setup that drainers exploit. Stale approvals to small or empty token balances matter less, because there is little to take, though clearing them still tidies your risk surface.

How do you clean up your approvals in 15 minutes?

A short, repeatable routine keeps the standing risk low without turning into a chore. Run it after any busy period of swapping or minting, and at least once a quarter:

1. Load your address into an approval checker and read the full allowance list.
2. Flag every unlimited allowance and every spender you cannot identify.
3. Revoke the flagged approvals on tokens you hold in meaningful size first.
4. Repeat the check on each chain where the address has been active.
5. Screen the wallet for sanctions, mixer, and stolen-funds exposure to confirm nothing risky was inherited.

Related: Address Poisoning: The Lookalike Address in Your History · Why Did My Bank Account Get Frozen After a P2P Crypto Trade? · Run the related screening check

FAQ

Does revoking a token approval cost gas?

Yes. A revoke is an on-chain transaction that resets the allowance to zero, so it carries a normal gas fee. Batching several revokes in one low-fee session keeps the cost down.

Does revoking recover tokens that were already stolen?

No. Revoking only closes the permission going forward. If a contract already moved your tokens, the revoke cannot reverse that transfer - it just prevents any further withdrawals on that allowance.

How often should I check my token approvals?

At least once a quarter, and after any stretch of heavy swapping or minting. New approvals accumulate quickly, and an unused one from months ago is the kind that turns into a problem.

Does revoking approvals protect me from wallet drainers?

It removes one common attack path - the exploited or malicious contract that already holds an allowance. It does not stop you from signing a fresh malicious approval or a harmful permit, so caution at signing time still matters.

What is an unlimited approval and why is it the default?

An unlimited approval lets a spender move any amount of a token indefinitely. Interfaces default to it so you approve once instead of paying a fee before every trade, but it maximizes what a compromised contract can take.