A token approval grants a smart contract permission to move a specific token from your wallet. Approvals persist indefinitely until revoked, so a contract exploited years later can still drain wallets that left an unlimited approval open. Review and revoke old approvals every few months at revoke.cash.
Why approvals exist at all
Token standards separate ownership from permission. A contract cannot take your tokens, but you can authorize it to move them on your behalf. Without that, a decentralized exchange could not execute your swap.
The design is sound. The problem is convenience: most interfaces default to requesting an unlimited approval so you never have to approve again, and unlimited means unlimited, forever.
The actual risk
You swap on a protocol in 2024
You approve unlimited USDC so you do not have to approve again.
You stop using it
You move on. The approval stays exactly where it was.
The contract is exploited in 2026
A vulnerability is found, or an upgrade key is compromised.
Your USDC is taken
Every wallet still holding an open unlimited approval is drained simultaneously. You did nothing wrong today.
How to review yours
Open a revocation tool
revoke.cash is the standard. Etherscan also has a token approvals page per chain.
Connect the wallet you want to audit
Or just paste the address, which lets you look without connecting at all.
Sort by risk
Unlimited approvals on assets you actually hold are the priority. An unlimited approval on a token you no longer own is harmless today and would matter again if you re acquired it.
Revoke anything you do not actively use
Each revocation is a transaction costing gas. On a layer 2 this is pennies. On Ethereum mainnet, batch it into a quiet period.
Repeat per chain
Approvals are per network. If you use Ethereum, Base, Arbitrum and Polygon, that is four separate reviews.
Better habits going forward
| Habit | Why it helps |
|---|---|
| Approve exact amounts, not unlimited | Costs the same gas and closes the permission automatically once spent |
| Review approvals quarterly | Twenty minutes, and it removes the accumulated tail of forgotten permissions |
| Use a burner for unfamiliar protocols | Approvals granted there cannot reach anything valuable |
| Keep the vault separate | A hardware wallet that never interacts with contracts has no approvals to exploit |
| Use a simulating wallet | Rabby flags unlimited approval requests before you sign |
NFT approvals are worse
For NFTs, the common permission is setApprovalForAll, which grants control over your entire collection from that contract rather than a single item.
Marketplaces require it to list, which is legitimate. It also means an exploited marketplace contract can move every NFT you own from that collection. Review these with the same discipline.
Common questions
Does revoking an approval cost money?
Yes, it is an onchain transaction and costs gas. On layer 2 networks it is a few cents. On Ethereum mainnet it is worth batching into a quiet period.
Can I revoke without connecting my wallet?
You can view approvals by pasting an address. Revoking requires a signed transaction, so you have to connect for that step.
Are approvals dangerous on their own?
Not immediately. The risk is future: an approval granted today can be exploited whenever that contract is compromised. The exposure is time, not the act.
What is Permit2?
A standard letting you approve by signature rather than an onchain transaction, which saves gas. It is legitimate and widely used, and drainers imitate it because the popup looks familiar.
Where to go next
Get a second pair of eyes on your setup
A security session reviews what you hold, where it sits, what approvals are open and what would happen if your laptop were compromised tomorrow. Most people find at least one thing worth fixing.