Go to revoke.cash, connect your wallet, review all active approvals (sorted by risk), and click Revoke on any you no longer need. Each revocation costs one small gas transaction. Do this monthly or after interacting with any new protocol. Unlimited approvals on forgotten contracts are the number one way drainer exploits steal tokens you thought were safe in your wallet.
How to Revoke Token Approvals
4 min read
The short version
Every time you used a DeFi protocol that asked you to approve spending your tokens, you gave that contract permanent permission to move those tokens from your wallet. Even after you withdrew your funds, that permission still exists. If that contract is ever exploited, the attacker can use your old approval to drain tokens you deposited months ago. Revoking removes that permission.
How It Works
What an approval actually is: when you call approve(spender, amount) on a token contract, you grant the spender address permission to call transferFrom() on your tokens up to that amount. Unlimited approval (the default on most DeFi UIs) sets the amount to the maximum uint256 value (effectively infinite). This means the approved contract can move ALL of your tokens of that type, not just what you deposited. The revocation process: (1) Visit revoke.cash and connect your wallet. (2) The tool scans the blockchain for all Approval events from your address. (3) It shows every active approval: which token, which spender contract, and how much they can still spend. (4) For each approval you want to revoke: click Revoke. This sends a transaction setting the approval to 0. (5) Confirm in your wallet, pay gas (typically $0.50-$5 on Ethereum, cents on L2s). When to revoke: after you stop using a protocol, after any protocol you used announces a security incident, monthly as a hygiene practice, and immediately if you suspect you signed something malicious. What it costs: one transaction per approval revocation. On Ethereum L1: $1-$5 each at moderate gas. On Arbitrum/Base: $0.01-$0.10 each. If you have 50 approvals to revoke on L1, batch them on a low-gas weekend.
Monthly approval cleanup on revoke.cash
You connect MetaMask to revoke.cash on Ethereum mainnet. It shows 34 active approvals. You sort by Newest and review: (1) Uniswap V3 Router: USDC unlimited approval. You still use Uniswap weekly. Keep it. (2) A random DEX aggregator you tried once 6 months ago: WETH unlimited. You no longer use it. Revoke. Cost: $2.10. (3) An old NFT marketplace: setApprovalForAll on your NFT collection. You moved the NFTs to another wallet months ago. Revoke. Cost: $1.80. (4) Aave V3: USDC approval for exact amount deposited ($5,000). This is safe (limited amount, reputable protocol). Keep it. After 15 minutes: you revoked 12 unnecessary approvals, spent $22 in gas, and eliminated 12 potential attack vectors. If any of those 12 contracts are exploited tomorrow, your remaining tokens cannot be drained through them.
What People Get Wrong
If I withdrew my tokens, the approval does not matter
The approval persists regardless of your balance. If you later receive more of that token (buy more USDC, get paid in USDC, claim rewards in USDC), the old approval STILL lets the contract move the new tokens. Approvals are permission on the token type, not on a specific batch of tokens.
Revoking costs too much to be worth it
On L2s (Arbitrum, Base): revocations cost 1-10 cents each. Even on L1, $2-5 per revocation is cheap insurance against potentially losing your entire token balance. One exploited unlimited approval could cost you everything. The gas cost is trivial relative to the risk.
I only need to revoke after I get hacked
By then it is too late. The point is prevention. A drainer exploit on a contract you approved months ago executes in one block. You will not have time to revoke after the exploit is announced. Regular proactive revocation is the defense.
Keep Reading
Sources & Further Reading
- Revoke.cash
Tool for auditing and revoking token approvals across EVM chains
- Etherscan Token Approvals
Etherscan built-in approval checker (alternative to revoke.cash)
Questions People Also Ask
- How often should I check approvals?
- Monthly is a good baseline. Additionally: always check after interacting with a new/unfamiliar protocol, after hearing about any DeFi exploit (even if you do not think you used that protocol), and before receiving a large token transfer to a wallet with old approvals.
- Can I set limited approvals instead of unlimited?
- Yes. When a DeFi interface asks you to approve, most wallets (MetaMask, Rabby) let you edit the amount. Set it to exactly what you are depositing instead of the default unlimited. This caps your maximum loss to that amount even if the contract is exploited. Rabby wallet does this by default.
- Does revoking affect my current DeFi positions?
- No. Revoking an approval only prevents FUTURE spending. Tokens already deposited in a protocol remain deposited. You would need to re-approve if you want to deposit more later. Your current positions, earned yield, and withdrawals are unaffected by revoking the approval.