Token approvals and how to revoke them

On blockchains such as Ethereum, you can connect your self-custody wallet to apps called decentralized applications, or dApps. Examples are token swap sites and lending apps. These apps run on smart contracts, which are programs stored on the blockchain.

What is a token approval?

Before a smart contract can move your tokens, you must give it permission. This permission is called a token approval or allowance. You sign it with your wallet, and it stays on the blockchain until you change it.

Many apps ask for an unlimited approval by default. That saves you a fee next time, because you do not need to approve again. But it also means the contract can move all of that token from your wallet, at any time, without asking again.

Why approvals can be dangerous

• If the app's contract is later hacked, attackers may use old approvals to drain wallets.
• If the "app" was a scam from the start, the approval is the theft itself. You signed a permission that lets the scammer take your tokens.
• Old approvals you forgot about stay active for months or years.

Safer approval habits

• Read what you sign. If your wallet says "approve", "set approval for all" or "permit", you are granting spending rights, not just logging in.
• Limit the amount. Many wallets let you edit the approval to the exact amount you need.
• Revoke when done. Use your wallet's built-in permissions page or a well-known approval checker from a block explorer to see and cancel old approvals. Revoking is itself a blockchain transaction, so it costs a small network fee.
• Use a separate wallet for experiments. Keep savings in one wallet that never connects to new apps, and use a second wallet with small amounts for trying dApps.

Approvals vs custody

Approvals only exist with self-custody wallets connected to smart contracts. Exchange accounts work differently. Still, the lesson is the same: every permission you grant is a door, and doors you no longer use should be closed.