Approvals: How to Revoke Token Permissions

Approve, allowance, Permit, Permit2, setApprovalForAll: understand token approvals, check them and revoke the ones you no longer need.

Security · Intermédiaire · 9 min read · Publié le October 29, 2026

The essentials

This guide is general information for educational purposes, and not investment, legal or tax advice.

Why approvals exist

On Ethereum and EVM-compatible networks, a smart contract can't take tokens from your wallet on its own initiative. For a DEX to swap your USDC, for example, two steps are needed:

Approve: you authorize the DEX's contract (the "spender") to spend up to a certain amount of your USDC.
Use: the contract then calls transferFrom to pull the tokens at the time of the swap.

The ERC-20 standard describes the approve function this way: it lets the spender withdraw tokens from your account, multiple times, up to the authorized amount. The allowance function shows the amount it can still pull. In other words, an approval isn't a one-off spend: it's a permission that stays open until you change it or it runs out.

The problem with unlimited approvals

To avoid making you pay approval fees on every use, many apps default to an "unlimited" amount (in practice, the maximum value of a 256-bit number). It's convenient, but it means the authorized contract can pull all of that token, including what you'll receive in the future.

Two loss scenarios:

Hacked contract: a legitimate app suffers an exploit; the attacker uses the existing approvals to drain the wallets of users who granted them, even if they haven't used the app for months.
Malicious contract: a fake site gets you to sign an approval in favor of an address controlled by a scammer, who then pulls your tokens.

Many wallets let you edit the amount proposed at approval time. Authorizing only the amount for the operation sharply limits exposure, at the cost of a new approval next time.

Signatures that count as approvals: Permit and Permit2

Permit (EIP-2612)

The EIP-2612 standard adds a permit function to ERC-20 tokens: instead of sending an approve transaction, you sign a message off-chain (in EIP-712 format) containing the owner, the spender, the amount, a nonce (an anti-replay counter) and a deadline. Anyone can then submit this message to the blockchain to activate the authorization.

Advantage: no fee for you when you sign. Major security drawback: this signature doesn't look like a transaction. A malicious site can present it as a simple "login". And because it's off-chain, it doesn't show up in any verification tool until the scammer has used it, which they usually do very quickly.

Permit2

Permit2 is a contract designed by Uniswap, usable with any ERC-20 token. According to its documentation, you first grant an approval (often unlimited) to the Permit2 contract itself, once per token. After that, each app gets its rights through signatures:

SignatureTransfer: a single-use signature, valid for one operation only.
AllowanceTransfer: an authorization for a given amount and a limited duration, with an expiration date.

Permit2 reduces exposure to permanent approvals, but shifts the risk to signatures: signing a Permit2 message on a fraudulent site can be enough to lose the tokens concerned.

Simple rule: any signature request that mentions "Permit", a spender, an amount and a deadline is an authorization to spend, even if no fee is requested.

NFTs: setApprovalForAll

The ERC-721 standard provides two types of authorization:

approve: authorizes an address to transfer one single specific NFT;
setApprovalForAll: designates an "operator" allowed to manage all your NFTs in a collection, present and future.

Marketplaces use setApprovalForAll heavily, because a single authorization covers the whole collection. It's also the preferred target of NFT scams: a fake "mint" or fake verification that asks for setApprovalForAll gives the scammer access to your entire collection. The ERC-1155 standard uses an equivalent mechanism.

How to check and revoke your approvals

Available tools

Block explorer checkers: Etherscan offers a "Token Approval Checker" that lists, for an address, the active approvals on ERC-20, ERC-721 and ERC-1155 tokens, with the spender, amount and date. It lets you connect with your wallet and revoke one or more authorizations. Explorers for other EVM networks often offer a similar tool.
Dedicated tools: sites like revoke.cash show approvals across many networks in one place and prepare the revocation transactions.
Your wallet: some wallets directly display the authorizations granted.

To simply look, you don't need to connect your wallet: pasting your public address is generally enough. Connecting is only needed to sign the revocation.

What does a revocation technically do?

According to revoke.cash's documentation:

for an ERC-20 token, revoking means calling approve with an amount of 0;
for a single-NFT approval, the authorized address is replaced with the null address;
for an NFT operator, you call setApprovalForAll with the value false.

A revocation is therefore an ordinary transaction, which you sign with your wallet. It only acts on the permission: it doesn't move your tokens.

Step by step

Open the checking tool by typing the address yourself or via a bookmark, never from a link received in a message or an ad.
Paste your public address and select the network.
Sort the authorizations: unlimited amount, unknown spender, app you no longer use.
Connect your wallet only to revoke, then check on your wallet's screen that the transaction calls approve with 0 or setApprovalForAll with false, and on the right token.
Repeat the operation on each network: an approval is specific to one network (Ethereum, a layer 2, etc.).
If you suspect a booby-trapped Permit signature, some tools let you cancel it before use by consuming its nonce, which also costs a transaction.

How much does it cost?

Each revocation is a transaction and so uses gas, paid in the network's native asset (ETH on Ethereum and most layer 2s). On Ethereum mainnet, the cost depends heavily on congestion at the time; on a layer 2, it's generally much lower. A few guidelines:

Revoking an approval on a token you no longer hold any of, and don't plan to buy back, is rarely a priority.
Revoking an unlimited approval on a token you hold in quantity, in favor of a contract you no longer use, is generally a good use of a few fees.
Always keep a little native asset on each network you use so you can revoke in an emergency.

What about Solana?

Solana doesn't use the ERC-20 standard, but Solana's Token program provides a comparable mechanism. According to its documentation, the owner of a token account can, with the Approve instruction, delegate authority over all or part of their balance to a third party (the "delegate"); that delegate can then transfer or burn up to the delegated amount. The owner can remove this delegation with the Revoke instruction (on the command line: spl-token approve and spl-token revoke).

On Solana, though, the main risk often comes from directly signed transactions: a malicious transaction can transfer your tokens without going through a prior delegation. So read your wallet's displayed simulation carefully before signing.

A concrete example

Thomas has used a DEX for two years. Opening the explorer's approval checker with just his public address, he discovers:

Token	Spender	Amount
USDC	Router of an abandoned DEX	Unlimited
WETH	Permit2 contract	Unlimited
NFT collection	Marketplace	All (operator)

He revokes the USDC approval to the DEX he no longer uses: it's the most pointless exposure. He keeps the Permit2 approval because he still uses apps that rely on it, but promises himself to only sign Permit2 messages on sites he opened himself. He revokes the NFT operator, since he no longer intends to sell his collection. Two transactions on a layer 2, for low fees, and his exposure has dropped significantly.

Mistakes to avoid

Believing a signature with no fee is harmless: a Permit or Permit2 message can authorize the withdrawal of your tokens.
Systematically accepting the unlimited amounts proposed by default.
Signing a setApprovalForAll for a "mint", a "claim" or a "verification" that has no need for it.
Clicking a "revoke your approvals urgently" link received in a message: it's a classic trap to get you to sign a malicious authorization.
Forgetting the other networks: revoking on Ethereum revokes nothing on a layer 2.
Thinking that revoking protects a compromised wallet: if your seed phrase is known to a third party, revoking is pointless; move the remaining funds to a new wallet.
Leaving the wallet with no native asset, which prevents you from revoking quickly.

Frequently asked questions

What is a crypto approval?

A permission that lets a contract spend your tokens on your behalf, up to a set amount. It stays active after use, sometimes with no amount limit, which makes it a target for scams and hacks.

How do I revoke an approval?

Paste your address into a block explorer's checker (such as Etherscan's Token Approval Checker) or a dedicated tool such as revoke.cash, sort the permissions, then connect your wallet only to sign the revocation. Repeat on each network.

Does revoking an approval cost fees?

Yes: a revocation is an ordinary transaction that uses gas, paid in the network's native asset. It is usually much cheaper on a layer 2 than on Ethereum.

Do I need to connect my wallet to check my approvals?

No: to view them, pasting your public address is usually enough. Connecting is only needed to sign the revocation.

Key takeaways

An approval authorizes a contract to pull your tokens, multiple times, up to the set amount; it stays active after use.
Unlimited approvals and setApprovalForAll expose all of a token or a collection if the contract is hacked or malicious.
Permit (EIP-2612) and Permit2 turn a simple signature into an authorization: read every signature request.
Check your approvals with an explorer's checker or a dedicated tool, network by network; revocation is a transaction that costs gas.
On Solana, the equivalent is delegation (Approve / Revoke) on a token account.
Build the habit: limited amounts, a wallet dedicated to risky apps, regular review of authorizations.

Sources

Compare services related to this topic

Best crypto wallet: comparison