Token approvals: how to check and revoke them

What you are actually signing

Token standards separate holding from spending. To let an application swap, stake or bridge your tokens, you first approve that application’s contract to move them. MetaMask describes allowances as permitting applications to access and move tokens in your wallet on your behalf.

The important properties: the approval is per token and per contract; it has an amount, which is often set to a very large value so you are not asked again; and it lasts until you change it. None of that is visible once you have moved on to the next thing.

Disconnecting is not revoking

This is the single most common misunderstanding, and MetaMask addresses it directly: disconnecting your wallet from an application cancels its permission to see your address and balances, but revoking an approval is what actually prevents it from moving your tokens.

So a site you disconnected last year may still hold an allowance over a token you still hold. Closing the tab changes nothing. Uninstalling the application changes nothing. Only a revocation transaction does.

How to see what you have granted

Block explorers provide approval checkers. Etherscan has one, and the equivalent explorers for other EVM networks provide the same function for their own chains. Connect or paste your address, and you get a list of tokens, the contracts permitted to move them and the amounts approved.

Some wallets also surface this directly. MetaMask lets you view allowances and submit revocations from its own portfolio interface on supported networks.

Check each network separately. Approvals are per chain, so a clean list on Ethereum says nothing about what you granted on Polygon or Arbitrum.

Revoking, and what it costs

A revocation is an ordinary transaction: it sets the allowance to zero and pays a network fee to do so. That means revoking everything at once on a busy network has a real cost, and it is reasonable to prioritise.

Revoke first where the exposure is largest: unlimited allowances over tokens you hold in meaningful quantity, granted to contracts you no longer use or never intended to use. Small allowances on tokens you do not hold are a lower priority.

Where your wallet offers it, setting a specific spending cap instead of an unlimited one at the moment of approval avoids the problem prospectively. It means approving more often, in exchange for a smaller standing exposure.

Malicious approvals

A whole category of theft works by getting you to sign an approval rather than a transfer. The prompt is for a site you were persuaded to visit, the token is one you hold, and the amount is unlimited. Nothing moves at the moment you sign; the funds leave later.

Two habits help. Read what the prompt is asking for: an approval and a transfer are different requests, and wallets label them differently. And be suspicious of any urgency — a "migration", a "validation", a "claim" that must happen now. Unexpected tokens arriving in your wallet are sometimes bait for exactly this, so do not interact with tokens you did not expect.

If you believe you signed something you should not have, revoke the approval immediately and move the affected tokens to a new address if the exposure is large.