Batch Revoke Token Approvals: Step-by-Step

DeFi Intel Research · Updated 2026-07-02 · intermediate

Every token approval you've ever signed is a standing permission for a smart contract to move your assets. Over time, these approvals accumulate—leftover from DeFi farms, expired DEX trades, or forgotten NFT mints. Each one is a potential exploit vector: if the approved contract gets compromised, or if you interact with a malicious dApp, the attacker can drain those approved tokens without further consent from you.

This guide teaches you how to batch revoke multiple token approvals at once using tools like Revoke.cash. You'll learn the core mechanics of ERC-20 allowances, why batch revocation is critical for security hygiene, and a step-by-step workflow that works across Ethereum, Arbitrum, Optimism, Polygon, and other EVM chains. No live prices, no hype—just concrete, durable steps to minimize your attack surface.

Why Batch Revoke Token Approvals Matters

Revoking approvals individually through Etherscan or a wallet's built-in UI is impractical if you have more than a handful of contracts. Each revocation costs a separate transaction, and you must manually search for every approval. Batch revocation solves this by scanning your address across multiple chains and presenting a consolidated list of all active allowances. You can then select which to revoke and process them in a single batch transaction—often saving gas compared to individual revocations.

The security rationale is straightforward: any approval you don't need is a liability. In the first half of 2024, over $200 million in losses from DeFi exploits were tied to unchecked approvals. While that figure is illustrative, the pattern is clear—hackers routinely target old, high-value approvals. By regularly batch-revoking unused permissions, you reduce the damage surface to zero for those contracts.

A single batch revoke can cost as little as 60,000–80,000 gas (depending on network conditions), whereas revoking ten approvals individually might cost ten times that. Batch tools exploit gas-efficient patterns like multi-call or delegatecall.

Additionally, batch revocation helps you maintain a clean mental model of which contracts currently have access to your tokens. This is especially important if you use a hardware wallet or a multi-sig, where each transaction is a deliberate action.

Understanding Token Approvals: ERC-20 and Permit

At the protocol level, a token approval is a mapping stored in the token contract: owner => spender => allowance. When you call approve(spender, amount) (or use permit for gasless approvals), you authorize the spender contract to transfer up to amount of your tokens. This is how DEXs, lending platforms, and yield aggregators move your funds.

• Unlimited approvals (e.g., type(uint256).max) are common for convenience, but they leave the entire balance at risk if the spender contract is exploited.
• Finite approvals are safer but require frequent re-approvals, which many users avoid.
• Permit (EIP-2612) allows off-chain signature approval submission, but the resulting allowance behaves identically once on-chain.

The critical point: approvals persist indefinitely unless explicitly revoked (by setting allowance to zero) or overwritten by a new approval. They do not expire. So a contract you approved in 2021 can still move your tokens today, even if you no longer use the dApp. Batch revocation tools identify all these lingering allowances in one sweep.

The Risks of Unused Approvals

Leaving stale approvals open is like leaving a spare key under your doormat—except the key works indefinitely and anyone with the address can use it. The primary risks are:

• Contract exploits: If the approved spender contract gets hacked (e.g., a proxy implementation upgrade or a reentrancy bug), the attacker can call transferFrom to drain your tokens up to the allowed amount.
• Phishing approvals: A malicious dApp may trick you into signing an approval for a specific asset, then later use that approval when you least expect it. Batch revocation after a likely phish can prevent loss.
• Social engineering / supply chain attacks: Even legitimate dApps can be compromised via frontend or DNS attacks. If you approved a dApp before it was malicious, that approval can be exploited retroactively.

For example, in frontend or DNS hijack attacks—where a legitimate project's website or domain is compromised—approvals signed to an attacker-controlled contract can be harvested and later used to drain funds. Users who had previously approved the legitimate Curve contracts were safe because the approvals were for the legitimate address; but if those users had also approved a now-compromised contract (e.g., a deprecated pool), they would be at risk. Batch revocation tools allow you to sweep all approvals on a contract address basis, not just token-by-token.

Tip: Revoke approvals to any contract that you no longer actively use, especially if the contract has low liquidity, is unverified, or has been flagged on platforms like TokenSniffer or DeFiSniper.

Even if you trust the dApp, consider the human error factor: you might accidentally approve a high allowance to a phishing site that mimics the real one. Batch revocation after a cleaning session gives you a clean slate.

Introducing Revoke.cash and Alternatives

Revoke.cash is the most widely used batch approval revocation tool. It supports 30+ EVM chains, including Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, Avalanche, and many L2s. It provides a unified dashboard showing all token approvals (ERC-20 and ERC-721) for a given address. Key features:

• One-click connect wallet (MetaMask, WalletConnect, hardware wallets).
• Select multiple approvals to revoke in a single batch transaction (on wallets that support transaction batching).
• Gas estimation before sending.
• Aggregation across networks (though you must switch networks manually).

Alternatives include:

For most users, Revoke.cash strikes the best balance of convenience, security, and multi-chain support. The interface is intuitive: after connecting your wallet, it scans the active chain for all approvals and displays them with contract name, token symbol, allowance, and a revoke button.

Step-by-Step: Batch Revoke with Revoke.cash

Follow these steps to revoke multiple token approvals at once on any supported network:

1. Go to revoke.cash and click Connect Wallet. Choose your wallet (MetaMask, WalletConnect, hardware). Ensure you are on the correct network (e.g., Ethereum mainnet).
2. Scan your approvals: After connecting, the page automatically fetches all token approvals for the connected address on that chain. Wait a few seconds for the list to populate. You'll see token icons, contract addresses, approved spenders, and allowance amounts.
3. Review and select: Scan through the list. Pay special attention to unlimited approvals or contracts you don't recognize. You can click the token name to see the contract on a block explorer. Be cautious: revoking an approval to a contract you still use (e.g., Uniswap) will break any open trading positions that rely on that approval—you'll need to re-approve to trade again.
4. Select multiple: Check the boxes next to each approval you want to revoke. Revoke.cash supports batch selection via the checkbox column header.
5. Review the batch: A pop-up shows the list of approvals to revoke and the estimated gas cost. Check that you haven't included any critical active approvals.
6. Confirm and sign: Send the transaction via your wallet. Your wallet will send a series of approve(spender, 0) calls (bundled into one transaction if your wallet supports batching). Wait for confirmation.
7. Verify: After the transaction confirms, refresh the page or use the scan again to ensure the allowances are now zero. Repeat on other chains if needed.

Important: Revoke.cash does not store your private keys or send transactions on your behalf. All actions are initiated from your wallet. Always double-check the contract addresses in the batch.

If you own NFTs, Revoke.cash also supports batch revoking NFT approvals (ERC-721). The process is identical—just look for the NFT tab after connecting.

Security Best Practices for Approval Management

To maintain a tight security posture, incorporate approval revocation into your regular wallet hygiene:

• Schedule periodic checks: Every 3–6 months, or after using a new dApp, run a scan on Revoke.cash or similar tool. Many users set a calendar reminder after major network upgrades.
• Use limited approvals: When possible, approve only the exact amount needed for a single transaction. Some dApps (like Uniswap) allow custom approval amounts. Combine this with approval expiration (for ERC-20 tokens that support it via EIP-2612, though expiration is off-chain; you still need on-chain revocation to fully remove the allowance).
• Monitor approvals: Use wallet notifications or services like Fire or Zapper to alert you when new approvals are created. Some hardware wallets show the approval details before signing.
• Revoke on networks you rarely use: If you bridged once to Polygon years ago and still have unlimited ERC-20 approvals (e.g., to a DEX you no longer use), revoke them. An exploit on a sidechain could still move assets if the same token is bridged.
• Beware of revoke scams: Only use Revoke.cash’s official domain (revoke.cash) or its verified GitHub releases. There are phishing sites that mimic the UI to steal approvals. Always check the URL and SSL certificate.

Remember: revoking approvals is non-reversible (unless you re-approve). If you accidentally revoke an approval to an active contract, you simply need to re-approve it the next time you interact. It's an inconvenience, not a loss. The security gain far outweighs the occasional re-approval.

Frequently asked questions