The scariest thing in my wallet is not a token I bought and regret. It is a line I signed maybe two years ago, to a contract I have not thought about since, that still has permission to move a token I do hold. I did not lose anything. But the permission is sitting there, live, waiting on a contract I no longer trust to have never been compromised. That is what a token approval is, and almost nobody goes back to clean them up.
So let me walk through what an approval actually grants, because the mental model most people carry is wrong in a way that matters. When you swap on a DEX, or deposit into a lending market, or mint something, the app does not touch your tokens directly. ERC-20 tokens do not let arbitrary contracts pull your balance. Instead you sign an approve transaction that tells the token contract: this specific spender address is allowed to move up to this amount of this token on my behalf. After that, the app can call transferFrom whenever it needs to, up to the limit you set, without asking you again. That is the whole point. It is what makes a swap feel like one click instead of two.
Where the risk actually lives
The approval is a standing grant, not a one-time pass. It does not expire. It does not shrink after the swap you wanted. If you approved an unlimited amount, and most apps default to unlimited because it saves you a second transaction later, then that spender can move your entire balance of that token, forever, until you revoke it or the balance hits zero.
For a contract that stays honest and never gets exploited, this is invisible and harmless. The problem is that you are not really trusting the app you used. You are trusting the contract behind it, and every future version of the world in which that contract might be upgraded, might have a bug found in it, or might have an admin key that gets phished. Plenty of losses that get described as hacks were not people signing a malicious transaction on the spot. They were old unlimited approvals to a contract that later turned out to be exploitable, drained long after the user stopped thinking about it.
A few flavors of this are worth naming, because they fail in different ways:
- Unlimited ERC-20 approvals to a real protocol. Low probability of going wrong, but if that protocol is ever compromised, your whole balance of that token is reachable. The classic silent risk.
- Approvals to a contract you interacted with once. A random airdrop-claim site, a mint, a bridge you used a single time. You will never use it again, so the approval is pure downside with zero upside.
- NFT approvals, especially setApprovalForAll. This one grants a spender the right to move every NFT in a collection you hold, not a single token. A lot of NFT phishing works by getting you to sign exactly this, dressed up as a free mint. Worth auditing separately because the blast radius is a whole collection.
- Permit2 and signature-based approvals. Newer flows move the approval into an off-chain signature you sign in your wallet. Convenient, and often safer because the amounts and expiries are baked in, but they still create real allowances under the hood that show up in an audit.
How to audit what you have already signed
The good news is that allowances are public on-chain state, so any tool can read them for you. The workflow I use is boring and takes about ten minutes per wallet.
- Open a revocation tool. Revoke.cash is the one most people reach for, and Etherscan has a token-approvals page under its token tools. Both read directly from chain, so they show the same underlying allowances.
- Paste your address, or connect the wallet read-only. You are just reading state at this point, so nothing is signed and nothing is at risk yet.
- Sort by what can actually hurt you. Look first at unlimited allowances on tokens you hold a real balance of, and at any setApprovalForAll on NFT collections. An unlimited approval on a token you have zero of is not urgent. An unlimited approval on the stablecoin that makes up most of your wallet is the first thing to fix.
- Revoke the ones you do not recognize or no longer use. Each revocation is its own on-chain transaction, so it costs gas, which is why you want to batch this on a day fees are low rather than doing it one at a time in a panic.
- Repeat per chain. Approvals are chain-specific. Your allowances on Ethereum mainnet, Arbitrum, Base, and Polygon are separate ledgers, and the tool needs to be pointed at each network to show them.
One thing that trips people up: revoking an approval does not undo a past theft, and it does not move your tokens. It only closes the door for the future. If a contract has already been drained, revoking after the fact does nothing. The value of revocation is entirely preventive, which is exactly why it feels unrewarding and gets skipped.
Unlimited versus exact, and when each makes sense
Here is the tradeoff in plain terms. An unlimited approval means you approve once and never think about the allowance again, at the cost of standing exposure to the whole balance. An exact approval means you approve only the amount this specific action needs, so your exposure is capped at that amount, at the cost of a fresh approval transaction and its gas the next time you interact.
My rough rule: for a protocol I use constantly and trust, like the main DEX or lending market I actually live in, I will accept an unlimited approval because the convenience is real and I am watching that contract anyway. For anything I am touching once, or a newer protocol I have not formed a view on, I set an exact amount even though it costs me a second transaction later. Most wallets and DEX front-ends now let you edit the approval amount before signing, and if the interface hides that option, that itself is a small signal about who built it.
The habit that keeps a wallet clean is not heroic. Put a revocation audit on a calendar, roughly quarterly, and tie it to something you already do, like the day you rebalance or do your taxes. Prefer exact approvals for anything you will not reuse. And keep a separate hot wallet with a small balance for minting and experimenting, so the address you connect to unknown contracts is never the one holding the bulk of your funds. A drained throwaway is an annoyance. A drained main wallet is a bad quarter.
This is the same instinct behind watching wallets in general. When we built the wallet-tracking side of Blockcircle, half of what makes an on-chain address readable is knowing which contracts it has granted power to and which it has not. Your own wallet deserves the same read. Approvals are the part of self-custody that does not announce itself, and the ten minutes it takes to go through them is cheap insurance against the one contract you trusted and forgot.