How to Revoke Token Approvals and Protect Your Crypto Wallet

Every time you swap tokens on Uniswap, Aerodrome, or any EVM decentralized exchange, you sign an approval transaction before the swap executes. This approval tells the token contract: “this DEX router is allowed to move my tokens.” Most approvals are set to unlimited by default, meaning the router can move any amount at any time, forever. If that router contract is ever exploited, every wallet that approved it is vulnerable. This guide explains how to audit and revoke these permissions before they become a liability. It connects directly to the wallet security practices in our scam prevention guide.

What Are Token Approvals and Why Do DEXs Require Them?

The ERC-20 standard, documented in Ethereum’s developer documentation, defines two key functions: approve(spender, amount) and transferFrom(from, to, amount). When you approve a DEX router, you call approve with the router’s address and an amount. The router then uses transferFrom to pull tokens from your wallet during the swap.

Most DEX interfaces set the approval amount to the maximum possible value: 2^256 – 1, or roughly 1.15 x 10^77 tokens. This “unlimited approval” means you only need to approve once per token per router, saving gas on future swaps. But it also means the router contract has permanent permission to drain your entire balance of that token.

This is not theoretical. In March 2023, the Euler Finance exploit allowed attackers to drain $197 million from wallets that had approved the compromised contract. Chainalysis documented that approval-based attacks accounted for a significant portion of DeFi losses that year. The defense is simple: revoke approvals you no longer need.

How Do Unlimited Token Approvals Become a Security Risk?

Attack vector one: contract exploits. When a DEX router or DeFi protocol has a vulnerability, the attacker gains the ability to call transferFrom on behalf of every wallet that ever approved that contract. The approval exists on-chain and does not expire. A contract you approved six months ago still has permission to move your tokens. According to Rekt News, seven of the ten largest DeFi exploits involved draining wallets through existing approvals.

Attack vector two: phishing approvals. A scam site mimics a legitimate DEX interface and prompts you to “approve” a token. Instead of approving the real DEX router, you approve a malicious contract controlled by the attacker. The attacker then calls transferFrom to drain your approved tokens. This attack requires only one mistaken click on a fake website.

Solana works differently. The SPL token standard does not use the same approval model. Instead, Solana uses “delegate” authority, which can be revoked by the token holder at any time. However, Solana wallets face a parallel risk from malicious transaction signing, where a dApp requests broader permissions than displayed in the wallet popup.

How Do You Check and Revoke Approvals on Ethereum and Base?

Revoke.cash is the standard tool for managing EVM token approvals. It supports Ethereum, Base, Arbitrum, Optimism, Polygon, BNB Chain, and over 60 additional networks. Connect your wallet and the interface scans your on-chain approval history. Each row shows the token, the approved spender contract, the approved amount, and when the approval was granted.

Sort approvals by risk level. Unlimited approvals on contracts you used once months ago are the highest priority. Revoke those first. Active approvals on DEXs you use daily (Jupiter router, Uniswap router) can remain, but consider reducing them to specific amounts rather than unlimited.

Etherscan also offers a token approval checker at etherscan.io/tokenapprovalchecker. It provides the same data as revoke.cash but only for Ethereum mainnet. For Base, use revoke.cash or the Rabby wallet’s built-in approval manager, which proactively alerts you when approvals are suspicious.

How Do You Manage Token Permissions on Solana?

Phantom wallet, the standard Solana wallet, added a built-in approval manager that shows every active delegate authority on your tokens. Navigate to Settings, then Security and Privacy, then “Trusted Apps.” This screen lists every dApp you have connected and the permissions granted. Disconnect any app you no longer use.

For a deeper view, Solana.fm shows all token accounts associated with your wallet, including any delegated authorities. If a token account shows a delegate address, that address can transfer your tokens. Revoke the delegate by sending a revoke instruction through your wallet.

The practical risk on Solana is lower than EVM chains because Solana transactions must be explicitly signed for each transfer. There is no persistent “unlimited approval” equivalent. However, malicious dApps can request transaction signing that includes hidden instructions. Always review the full transaction details in Phantom before signing, especially on unfamiliar sites. Our beginner’s buying guide covers safe wallet practices in depth.

What Is the Best Practice for Managing Approvals Going Forward?

My strongest recommendation: use a separate “hot wallet” for meme coin trading that holds only the capital you are actively trading. Your main holdings should sit in a different wallet that never approves any DeFi contract. This architecture means a compromised approval can only drain your trading wallet, not your savings.

When swapping on any DEX, change the approval amount from unlimited to the exact amount you plan to swap. On Uniswap, click “Edit” next to the approval amount before confirming. On MetaMask, you can modify the approval value in the transaction details popup. This extra click takes three seconds and limits your exposure to the current trade amount.

Set a weekly calendar reminder to check revoke.cash. Revoke any approval from the past week for contracts you do not plan to use again. This habit is the single most effective wallet security practice beyond seed phrase protection, and it complements the contract verification steps in our honeypot detection guide.