How to Revoke Token Approvals

How to revoke ERC-20 token approvals to remove old or malicious spender permissions: revoke.cash, Etherscan token-approval tool.

What you'll need (prerequisites)

• Self-custodial wallet
• A second device for verification
• Block explorer (Etherscan, Solscan, etc.) familiarity

Step-by-step

1. Step 1: Understand what token approvals are

   A token approval (allowance) is on-chain permission you grant a smart contract to move a specific ERC-20 token from your wallet. Many dApps request a maximum, effectively unlimited allowance so you never have to re-approve, but that permission stays live until you revoke it. If that spender contract is later exploited or was malicious to begin with, it can drain the approved token with no further signature from you.

2. Step 2: Open an approval checker

   Go to revoke.cash and connect your wallet, or paste your public address to review it read-only. You can also use the explorer's built-in tool at etherscan.io/tokenapprovalchecker, and each chain has its own such as Basescan or Arbiscan. Make sure the checker is set to the same network as the wallet you want to audit.

3. Step 3: Review your active allowances

   The tool lists every active approval with the token, the spender contract, and the approved amount. Flag anything shown as Unlimited, any spender address you do not recognise, and approvals tied to sites you no longer use. The spender label and contract link help you tell a legitimate router such as Uniswap from an unknown or suspicious address.

4. Step 4: Revoke the risky approvals

   Click Revoke next to each unwanted allowance and confirm the transaction in your wallet. A revoke is a real on-chain transaction that resets the allowance to zero, so it costs gas in the chain's native token — keep a small balance for fees. On revoke.cash you can also use the pencil icon to lower an allowance instead of removing it entirely.

5. Step 5: Confirm the allowance is now zero

   After the transaction confirms, refresh the checker and verify the approval has disappeared or now reads zero. Each revoke is specific to one token and one spender, so repeat the process for every risky entry — clearing one does not affect the others. Only when the list is clean are those tokens no longer exposed to that contract.

6. Step 6: Stay safe going forward

   Prefer limited, exact-amount approvals over unlimited ones whenever a dApp gives you the choice, and put a periodic allowance review on your calendar. Consider a separate burner wallet for mints and new or unaudited dApps so your main holdings are never exposed. The revoke.cash browser extension can also warn you before you sign a suspicious approval or permit signature.

Common errors and fixes

• Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
• Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
• Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
• Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
• Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.

FAQ