Knowing how to revoke token approvals matters because disconnecting your wallet does not necessarily remove a smart contract’s permission to spend your tokens. You can close a website, remove it from your connected apps and still leave an approval active on the blockchain.
The short answer is no: disconnecting alone is not enough to revoke an existing token allowance. Ethereum’s official guide makes this distinction explicitly.
That does not mean every connected app can empty your wallet. What matters is the permission you granted: which asset it covers, who can use it and how much they are allowed to spend.
This guide explains those permissions and gives you a practical way to review them.
Last reviewed: October 29, 2026. This article focuses on Ethereum and compatible EVM networks. Other blockchains and smart-account systems can use different permission models.
What is a token approval?
A token approval gives another address—often a smart contract—permission to spend a specified token from your wallet.
This is common when using a decentralised exchange or lending protocol. Before a contract can move your tokens as part of a swap or deposit, it may need your authorisation.
With standard ERC-20 tokens, the permission is called an allowance. It identifies the spender and the amount they may use. Giving an allowance does not itself transfer the tokens; it enables an authorised spender to move them later within the permitted scope.
A useful distinction is:
Approval: Permission to spend.
Transfer or swap: The action that moves or exchanges assets.
They may appear as separate requests, although some applications combine steps or use signed permissions.
An ordinary direct transfer from your wallet to another address generally does not require granting an unrelated contract a spending allowance. Our USDT transfer guide explains that simpler sending process.
Connecting, signing and approving are different actions
Wallet pop-ups can look similar even when they authorise very different things.
Action | What it generally does | What to check |
|---|---|---|
Connect wallet | Lets the app interact with selected wallet accounts and request actions | Website identity and requested connection permissions |
Sign a message | Authenticates something or authorises an action, depending on the message | The actual meaning of the signature |
Approve a token | Grants a spender permission over a particular token | Token, spender, network and spending cap |
Confirm a transaction | Authorises the displayed blockchain operation | Destination, operation, asset amounts and fees |
Disconnect | Ends the app’s wallet connection | Existing on-chain approvals remain |
Revoke approval | Removes the selected spending permission | Correct permission and confirmed execution |
MetaMask distinguishes app connection permissions from token approvals and notes that disconnecting does not revoke those approvals. Disconnecting also does not erase an address a website already knows or hide its public blockchain history.
Why unlimited approvals deserve attention
An unlimited allowance removes the need to approve the same spender repeatedly. That can make an application more convenient, but it also leaves broader permission in place.
Consider this illustrative example:
You hold 500 USDC and want to swap 50 USDC. The app requests an unlimited allowance.
After the swap, you disconnect and assume the relationship is finished. But the allowance can remain active. If that spender is malicious or later becomes exploitable, the remaining balance—and future deposits of that token—may be exposed.
An exact allowance of 50 USDC limits that particular spending permission. It does not establish that the application is safe or protect you from other harmful requests.
Approval risk is therefore about both scope and trust: how much access you granted and whether the spender can be relied upon.
How to revoke token approvals: a practical walkthrough
1. Open a verified approval-management tool
Start through your wallet provider’s official guidance or type a known address yourself.
Options documented by Ethereum and wallet providers include:
An appropriate blockchain explorer’s approval checker.
A supported approval-management feature in your wallet.
Avoid “urgent wallet cleanup” links sent through direct messages or unsolicited tokens.
You do not need to reveal your seed phrase or private key to inspect or revoke approvals.
2. Select the correct account and network
Check the wallet address first, then select the network where you used the application.
An Ethereum approval is separate from an approval on Base, Arbitrum or another network. Reviewing one chain does not review every chain where you have used the same address.
Revoke.cash allows users to inspect an address before connecting a wallet. A wallet connection and authorisation are needed when submitting a revocation.
3. Read the permission before removing it
Look for:
Field | Why it matters |
|---|---|
Token or collection | Identifies the asset covered by the permission |
Spender or operator | Identifies who can exercise the permission |
Allowance | Shows the spending limit or broader access |
Network | Establishes which blockchain the permission belongs to |
Approval history | Helps connect the permission with an action you remember |
An unfamiliar spender address is not automatically malicious. Applications may use routers and other contracts with names that are not obvious.
Verify unfamiliar entries using official project documentation or recognised explorer labels. Prioritise suspicious permissions and access you no longer need.
4. Review and submit the revocation
Choose the relevant permission and select Revoke.
For a typical ERC-20 allowance, revocation sets that spender’s allowance to zero. The wallet should show the proposed operation and fee. Read those details before confirming.
You normally need a way to pay the network fee on that chain. Some tools may also charge for optional services such as batching; inspect the current quote rather than assuming every feature is free.
Reject a request that unexpectedly grants a new large allowance or transfers assets elsewhere.
5. Wait for confirmation and verify the result
Submitting a revocation is not the same as completing it.
Wait for the transaction to confirm, then refresh the approval list. Check that the allowance is zero or that the relevant permission is no longer active.
If it remains pending, follow our crypto transaction pending troubleshooting guide. A revocation still waiting for inclusion has not yet removed the permission.
Repeat the review for other accounts and networks you use.
Real interface reference: what to look for
The screenshot below comes from Revoke.cash’s own tutorial. Use it to identify the network selector, spender and approved amount; the current interface may differ.
Source: Revoke.cash official tutorial. This is an interface reference, not a live report about your wallet.
What about NFTs and “Approve all”?
NFT permissions can work differently from fungible-token allowances.
Under the ERC-721 standard, an owner can approve a particular NFT or authorise an operator across their NFTs in that collection’s contract.
An Approve all request can therefore cover more than the one NFT you intend to sell. It does not automatically mean every NFT across every collection in your wallet. Check the collection contract and operator.
Review marketplace operator permissions separately from your USDT, USDC or other token allowances.
A gasless signature can still authorise something important
“No gas fee” does not mean “no financial consequence.”
Permit-style signatures can authorise token access without requiring you to broadcast an approval transaction at that moment. Someone else may submit the signed authorisation later.
MetaMask documents signature-phishing attacks in which a misleading request obtains an off-chain signature that can subsequently be used against the signer.
Before signing, examine the token, spender, amount, expiry and purpose where your wallet displays them.
A standard approval list is not a complete inventory of every unsubmitted signature. If you suspect you signed a malicious Permit or Permit2 request, follow the provider’s specific guidance for that permission type. Do not assume that an empty allowance list proves the wallet is safe.
What revoking cannot fix
It cannot reverse a completed theft
Revocation removes a permission for future use once the change takes effect. It does not undo an earlier transfer or recover assets already stolen.
It cannot repair exposed keys
If someone has your seed phrase or private key, they may sign new transactions and grant new permissions themselves.
Treat that as a wallet compromise requiring a new wallet with a newly generated recovery phrase on a trusted device. A second account derived from the exposed phrase does not solve the problem.
If newly added gas funds disappear immediately, do not keep topping up the account. A sweeper or other compromise may require specialised incident-response help. Revoke.cash warns that approval cleanup is insufficient in this situation.
It does not audit the entire wallet
Smart accounts can have session keys, delegated permissions or modules beyond ordinary token allowances. Those may require separate review in the wallet’s permission settings.
Revoking also does not withdraw assets already deposited into a lending or staking contract, repay debt or close an existing position.
Does a hardware wallet protect against approval abuse?
A hardware wallet protects signing keys, but an approval exploit does not necessarily require stealing those keys.
If you authorised the permission, an approved spender may use it without asking you to confirm each subsequent transfer. Carefully reviewing what you sign remains essential.
Our Hot Wallet vs Cold Wallet guide explains what hardware-based signing protects and where user checks still matter.
Practical approval-review checklist
Before granting access
I verified the website and the action I intended to perform.
I checked the token, network and spender.
I understand the spending limit.
I chose a limited amount where practical.
I read signature requests even when no gas fee was shown.
When reviewing existing permissions
I selected the correct account.
I checked each network I actually use.
I reviewed unused and unusually broad allowances.
I checked NFT operator permissions separately.
I investigated unfamiliar spenders rather than trusting a label alone.
When revoking
I opened the tool through a verified source.
I reviewed the proposed transaction and fee.
I waited for confirmation.
I verified that the selected permission was removed.
I considered whether the incident involves signatures or compromised keys, not just allowances.
FAQs
Is disconnecting my wallet enough?
No. Disconnecting ends the app connection but does not remove existing token allowances. Revoke the relevant permission separately.
Can an approved contract take every asset in my wallet?
A standard ERC-20 allowance covers a particular token and spender. It does not automatically authorise access to unrelated tokens or native ETH. However, multiple approvals, signed permissions or broader account authorisations can create additional exposure.
Do approvals disappear when my token balance reaches zero?
Not necessarily. A zero balance is different from a zero allowance. An active permission may still apply if that token returns to the account.
Does revoking require gas?
An ordinary on-chain revocation requires a network transaction, so network fees usually apply. Sponsored transactions and tool-specific charges can change what you pay.
Can I use an app again after revoking?
Usually, yes. If its next action requires token access, it may ask for another approval. Review that new request on its own merits.
Does revoking cancel a pending swap?
Not reliably. Revocation is a separate operation, and transaction ordering matters. Use the wallet’s supported transaction controls for a pending swap.
How often should I review approvals?
Review permissions after finishing with an application, after suspicious activity and when a service reports a relevant incident. Routine checks are also useful, but there is no single schedule that guarantees safety.
Will a wallet password change remove approvals?
No. A local password change does not alter on-chain permissions or replace an exposed private key.
