Why you should revoke old smart contract token allowances
You’ve approved a smart contract to spend your tokens. Maybe it was a DeFi protocol, a NFT marketplace, or a game. The approval felt routine: click, confirm, done. That approval can last forever. And that is the problem.
How ERC-20 approvals work
The ERC-20 token standard includes a function called approve. It lets a token holder grant permission for another address - usually a smart contract - to spend a specific number of tokens. The spender then uses transferFrom to move those tokens.
This is how almost every Ethereum-based application works. You approve a contract once, and it can pull tokens when you trade, stake, or swap. Without this mechanism, every transaction would require a separate approval, which would make the user experience unbearable.
Most protocols ask for an unlimited approval. You sign off on a maximum value of 2^256 - 1. That is more tokens than exist. The reason is convenience: you never hit a limit mid-transaction. But the trade-off is significant.
The risk of stale approvals
An approval does not expire. If you approved a contract in 2022 and never used it again, that approval remains active today; the contract still holds the right to drain those tokens from your wallet.
Consider what happens if the protocol suffers a hack. An attacker gains control of the contract. They call transferFrom on every address that ever approved it. Your tokens are gone. You did nothing wrong - you just never revoked an old permission.
The same risk applies to malicious contracts. Some projects launch, gain approvals, and then rug pull. The contract code may include a hidden function that drains approved tokens from any user. The approval stays open, and the drain can happen months later.
Auditing Your Approvals
You need to check what you have approved. Two tools make this straightforward.
Etherscan Token Approval Tool is free and requires no wallet connection to browse. Enter your wallet address. It lists every contract with an active approval, the token and the amount. For unlimited approvals, it shows an infinity symbol. You can revoke directly through the tool. Each revocation costs gas.
Revoke.cash is a dedicated platform for this task. It scans your wallet across multiple chains. The interface is cleaner than Etherscan’s. It shows approvals grouped by token and by contract. You revoke with one click. The site does not ask for your private key - it only prompts wallet signatures.
Both tools are read-only until you initiate a revocation. Use them to audit without risk.
How to Revoke
Step one: go to Revoke.cash or the Etherscan approval tool. Step two: connect your wallet. Step three: review the list. You will likely find approvals you forgot. Step four: click revoke on each one you no longer need.
Revoking sets the approval amount to zero. The contract can no longer spend that token from your wallet.
Do not revoke approvals you still use. If you actively trade on a DEX, revoking its approval will break your next trade; you would need to approve again. The point is to eliminate expired or suspicious permissions.
Make this a habit. Review your approvals every three months. Add it to your wallet hygiene routine alongside checking balances and updating software.
What you should revoke today
Start with any contract you no longer interact with. Protocols come and go. You may have tried a new platform once and never returned. That approval is dead weight.
Next, revoke contracts from protocols that have since been exploited or shut down. Even if the team patched the vulnerability, the old contract may still hold control. Why take the chance?
Finally, revoke unlimited approvals from any contract you barely trust. If the project seemed sketchy when you used it, the approval is a liability.
A Simple Habit
Smart contract approvals are necessary; they enable the entire DeFi and NFT ecosystem. But they do not need to be permanent. You control the permission, and you can revoke it.
Treat approvals like spare keys. You would not leave a copy of your house key under the mat for years. Do not leave unlimited token access open to old contracts.
A single audit today could prevent a loss tomorrow. Open Revoke.cash, check your approvals, and clean them up.
Not financial advice. thomasdank.xyz publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.