Connecting a wallet to a dApp and allowing it to spend tokens are two different actions. Closing the tab or pressing “Disconnect” removes the website session, but an on-chain token allowance can remain active for years. If the approved contract is malicious or later compromised, that permission may put tokens at risk.
Quick answer: review approvals separately on every network, verify the approval-management tool, revoke allowances you no longer need, and limit future approvals to the amount required. A revocation is an on-chain transaction, so it normally requires the network’s native token for gas.
What is a token approval?
Many fungible tokens use an approval model based on the ERC-20 standard. Your wallet address is the owner, while a smart contract is the spender. An approve transaction sets how many tokens that spender can transfer from your address through transferFrom.
For example, a decentralized exchange may request permission to spend 100 USDC so it can complete a swap. Some interfaces request an unlimited allowance to avoid another approval and gas fee next time. Unlimited approval is convenient, but it expands the amount exposed if the spender contract or front end becomes unsafe.
NFT standards have related permissions. An owner can approve one token or grant an operator permission over every NFT in a collection through functions such as setApprovalForAll. Read the wallet message carefully: approving one item and approving all items are materially different.
Disconnecting is not revoking
| Action | What it changes | Does it remove on-chain allowance? |
|---|---|---|
| Disconnect wallet | Ends or hides a website connection | No |
| Remove a connected site in the wallet | Stops that origin from automatically viewing/requesting through the session | No |
| Revoke approval | Changes allowance or operator status on-chain | Yes, after confirmation |
| Move tokens to another address | Removes current balance from the approved address | No; the old approval remains for future deposits |
How to review and revoke approvals safely
1. Identify the network
Approvals are network-specific. An Ethereum Mainnet review will not display allowances on Arbitrum, Base, BNB Chain, Polygon, or another chain. Create a list of networks where the wallet has held or used tokens.
2. Open a trusted approval checker
Use a block explorer’s official token-approval page or a well-established multi-network approval tool linked from a primary source. Type or bookmark the address yourself. Search ads and direct messages frequently imitate wallet tools.
Ethereum.org currently lists options including Etherscan, Blockscout, Revoke.cash, Unrekt, and EverRevoke. Availability and supported networks change, so confirm the domain through official documentation before connecting.
3. Inspect the spender, asset, and allowance
For each row, review:
- token contract and symbol;
- spender contract address;
- approved amount or unlimited status;
- date of the last related interaction;
- whether you still use the dApp; and
- whether the spender address matches the project’s current official documentation.
A familiar dApp name shown by a third-party interface is not proof. Contract labels can be incomplete or wrong. Compare addresses.
4. Choose what to revoke
Revoke approvals for unknown, obsolete, or unnecessary spenders. If you are uncertain, revoking is usually operationally reversible: you can grant a new approval when you next use a legitimate application. It does not normally close a lending, liquidity, or staking position by itself, although you should verify protocol-specific behavior.
5. Verify the transaction in the wallet
A standard fungible-token revocation usually sets an allowance to zero. Confirm the network, token contract, spender, and transaction function. Reject a request that unexpectedly transfers assets, grants another operator, changes account code, or asks for an unrelated signature.
6. Pay gas and wait for confirmation
The revocation changes blockchain state, so it requires gas. A pending or failed transaction has not removed the allowance. After confirmation, refresh the checker and inspect the token contract directly if needed.
What about Permit signatures?
Some tokens support signed approvals, often described as permit. Instead of sending the approval transaction yourself, you sign structured data and another party can submit it. This can improve user experience, but a malicious signature can still authorize spending.
A signature may include an owner, spender, value, nonce, chain, contract, and deadline. Never assume “no gas” means “no risk.” Read the decoded message in the wallet and reject blind signing. Some permit systems use separate nonce or revocation mechanisms, so a normal allowance checker may not represent every off-chain authorization state in the same way.
How often should approvals be reviewed?
There is no universal schedule. Review after interacting with an unfamiliar dApp, after news of a protocol compromise, before depositing a large balance into an old wallet, and as part of a periodic security routine. High-activity DeFi wallets need more frequent attention than a cold address that never connects to applications.
Consider using separate wallets by purpose:
- a low-balance interaction wallet for new dApps;
- a trading or DeFi wallet for established positions; and
- a storage wallet that rarely or never signs dApp requests.
This separation limits blast radius but adds backup and operational complexity. Our guide to self-custody wallets explains the broader hot-versus-cold trade-off. For smart-contract context, see what DeFi is and how it works.
Approval-security checklist
- Verify the domain and contract address through primary sources.
- Prefer an exact or limited allowance when practical.
- Do not approve tokens you are not about to use.
- Never share a seed phrase to revoke an approval.
- Do not sign unreadable messages from unsolicited links.
- Review NFT operator approvals as well as fungible-token allowances.
- Repeat the review for every network.
- Confirm revocations on-chain instead of trusting a success animation.
Frequently asked questions
Will revoking an approval return stolen tokens?
No. Revocation can prevent future use of that permission after confirmation. It cannot reverse a transfer that already happened.
Does revoking cost money?
Usually yes. It is an on-chain state change and requires the network’s native gas token.
Can an approval drain every asset in my wallet?
A standard allowance applies to a particular token contract and spender. Broad NFT operator approvals can cover a collection. Other malicious signatures or smart-account permissions may be wider, so always inspect the exact request.
Should I revoke every approval?
That is a risk and convenience decision. Removing unused permissions reduces exposure, while active dApps will require new approvals and gas.
This article provides general security education. If you suspect an active compromise, stop signing, preserve evidence, and seek help through verified official channels.