How to check and revoke token approvals

You signed a wallet pop-up months ago so a swap or bridge could move your USDC. The trade finished. You closed the tab. The permission often did not close with it. That leftover token approval (also called an allowance) can still let a smart contract pull those tokens later, without a fresh signature each time.

This guide is for EVM chains you already use in self-custody: Ethereum, Base, Arbitrum, Optimism, Polygon, BNB Chain, and similar. It pairs with sending safely, picking the right network, and planning gas. Those cover moving funds. This one covers the standing permissions that stay after the move.

Not financial advice. Revoking an approval is a normal on-chain transaction that costs gas. Practice on small balances first. Wallet and explorer UIs change; re-check the official docs before you sign with real value.

What a token approval actually is

On Ethereum-style chains, your wallet holds tokens (USDT, USDC, and others) that live in separate contracts. A dapp cannot simply grab them. First it needs your permission.

That permission is an ERC-20 approval: you tell token contract A that spender contract B may move up to a certain amount of your tokens. The next time you trade or stake, B pulls from that allowance instead of asking you for a full transfer of control.

Two details catch people:

1. Many dapps request an unlimited (or “infinite”) allowance so you do not re-approve every trade. Convenient. Also durable: if that contract is later compromised, or if you approved a malicious lookalike, the spender can drain the approved token until you revoke.
2. Disconnecting the site is not the same as revoking. MetaMask’s docs are explicit: disconnecting only stops the site from seeing your address in that session. The on-chain allowance remains until you send a revoke (or set the allowance to zero).

Hardware wallets keep keys offline. They do not block a spender that already holds a valid unlimited approval. Signing less often is good. Cleaning old approvals is still required.

Figure: An approval is a standing permission on the token contract. Disconnecting a website does not remove it.

Why this shows up for remittance and freelance users

You may never call yourself a “DeFi user” and still collect approvals. Common paths:

• A stablecoin swap or bridge while moving money across borders.
• An “energy,” “gas helper,” or “claim reward” site that asks for a token permission instead of a normal native-coin top-up.
• An NFT mint, airdrop claim, or staking page you tried once and forgot.

If you hold USDT or USDC in a self-custody wallet on an EVM chain and you have ever clicked Approve, you almost certainly have at least one active allowance. That is normal. Leaving unlimited approvals open for years on apps you no longer use is the habit to break.

Before you approve anything new

When a wallet pop-up asks for a spending cap, slow down.

1. Read the token and the spender. Is this the site you typed yourself from a bookmark or official docs? Phishing pages copy logos and ask for unlimited USDT first.
2. Prefer a limited amount when the wallet allows a custom spending cap (MetaMask documents this under customize token approvals). Approve what you need for this action, not “max.”
3. Never approve a random helper that wants your seed. Approvals are signed in-wallet. Seed phrases are never required to grant or revoke an allowance.
4. Keep gas ready. Approvals and revokes both cost the chain’s native coin. See gas planning.

Unlimited approvals for a protocol you use weekly are a trade-off some people accept. Unlimited approvals for a site you cannot name next week are not.

How to list your current approvals

You can inspect without revoking. Useful for a read-only check or a shared watch-only address.

Option A — Block explorer (single chain)

Each major explorer ships an approval checker. Examples:

Steps (same idea on each explorer; wording may vary slightly):

1. Open the Token Approvals / approval-checker page for the network where you hold tokens.
2. Paste your public address (or connect the wallet that owns it).
3. Review ERC-20 rows first (stablecoins and fungible tokens). Note NFT tabs if you use those standards.
4. For each row, read asset, approved spender, and allowance (often “Unlimited”).
5. Flag anything you do not recognize, or anything for a dapp you no longer use.

Etherscan’s Token Approvals explainer walks through the columns and the revoke button in more detail.

Option B — Multi-chain dashboard

Revoke.cash lists approvals across many networks from one interface. Official flow:

1. Open revoke.cash, connect your wallet or paste an address to inspect.
2. Select the network (or switch networks as you work through them).
3. Sort/filter for unlimited allowances and unknown spenders.
4. Use Revoke only for rows you intend to clear (that step needs the signing wallet and gas).

MetaMask also points users to explorer checkers and multi-network tools in its allowance guide. Some wallets and portfolio views add their own spending-cap screens; treat those as shortcuts, and still verify the spender on an explorer if something looks odd.

How to revoke an approval (step by step)

Revoking sets the allowance for that token + spender pair back to zero (or a lower amount, if the UI offers edit). It is a normal transaction from your address.

1. Fund gas on the same network as the approval (ETH on Ethereum or Base, BNB on BNB Chain, and so on).
2. Open a checker you trust (explorer page for that chain, or Revoke.cash).
3. Connect the wallet that owns the tokens when you are ready to sign. Viewing can be address-only; revoking cannot.
4. Find the row for the token and spender you want to clear.
5. Click Revoke (or set allowance to 0).
6. Confirm in the wallet. Read the network and fee. Sign only if those match what you intended.
7. Wait for confirmation, then refresh the list. The row should show zero or disappear.
8. Repeat per approval. Each revoke is usually its own transaction and fee.

If ETH you deposit for gas is swept instantly, that is a different problem: a compromised key or sweeper bot. Revoking will not fix a drained seed. Move to a new wallet generated offline or on a clean device, and never reuse the old seed. Revoke.cash’s FAQ states the same: preventative hygiene, not recovery of stolen keys.

A monthly hygiene checklist

1. List every EVM address you still use for real value (hot wallet, hardware companion account, old “test” address that still holds USDC).
2. Run each network you actually used this quarter through an explorer checker or Revoke.cash.
3. Revoke unlimited rows for dapps you no longer open.
4. Keep allowances only for tools you still trust and still use.
5. After a scam scare or a protocol exploit headline, re-check the same day. Speed matters more than the monthly ritual when a known contract is under attack.
6. Re-approve later only when you need that dapp again, with a limited cap when possible.

What this guide does not cover

• Solana uses different account and program permission models. Do not assume an EVM “approve” UI applies one-for-one.
• Tron has TRC-20 allowances with their own explorers and tools; the idea (standing spend permission) is similar, the product path is not identical.
• Permit / Permit2 / signature-based allowances can look like off-chain signatures rather than a classic approve transaction. Still treat them as spend permissions: if a wallet shows a high-risk signature, decline or use a tool that lists Permit2-style grants for your stack.
• Recovering funds after a malicious approval was already used. Once tokens left, you need incident response and chain analysis, not only a revoke. Revoke remaining allowances so the same spender cannot take more.

Takeaway

Self-custody is more than holding the seed. On EVM chains it also means managing the spend permissions you grant to contracts. List approvals on the explorer or a multi-chain checker, revoke what you no longer need, pay the small gas fee on purpose, and prefer limited spending caps the next time a dapp asks. Disconnecting a website is optional housekeeping. Zeroing old unlimited allowances is the control that actually closes the door.

If you are still building the full habit stack, keep seed phrase hygiene and block explorer skills close. Then put “check approvals” on the same calendar as “top up gas” before the next remittance cycle or freelance payout lands in USDC.