Every time you use a DeFi app for the first time, it asks you to sign an “Approve” transaction before the actual swap or deposit. Almost everyone clicks through without reading it. That click is a standing permission slip letting a smart contract move your tokens — and if the contract is malicious, or gets hacked two years from now, that forgotten slip is exactly how wallets get emptied. Checking and revoking approvals takes five minutes and is some of the cheapest security in crypto.
What an approval actually is
ERC-20 tokens — USDC, most DeFi tokens, anything that isn’t the chain’s native coin — live inside smart contracts, and only the token contract can move them. Before a DeFi app can spend your tokens, you must first sign an approve transaction telling the token contract: “this address is allowed to take up to X of my tokens.” That standing permission is called an allowance, and it sits on-chain until you remove it.
The catch: most apps request an unlimited allowance by default, because it saves you a gas fee on every future interaction. Convenient — but you’re not approving one trade. You’re handing a contract a permanent, uncapped line of credit against your balance of that token.
You can see this before signing: modern wallets display the “spending cap” in the confirmation window. If it reads “unlimited” (or an absurd number with 30 digits), that is the moment to decide — most wallets let you edit the amount right there. Reading that one line is 80% of the battle.
How approvals become drainer fuel
Wallet drainers — the scripts behind most phishing sites — usually don’t bother stealing your seed phrase. They get you to sign one approval to an attacker-controlled address, then empty your tokens at their leisure, hours or weeks later, calling the token contract’s transfer function. No further signatures needed; you already gave permission. The same mechanic hits honest users of honest protocols: when a DeFi contract gets exploited, attackers routinely drain everyone who ever approved it, including people who stopped using the app years ago. Old approvals are loaded weapons you left lying around.
NFTs have their own, worse version: setApprovalForAll, which grants a contract control over your entire collection in one signature. Marketplaces legitimately need it to list your NFTs; phishing sites ask for it to steal everything at once. Treat any unexpected setApprovalForAll request as a five-alarm fire.
How to check what you’ve approved
- revoke.cash — the standard tool, free and open source. You can paste your address without connecting a wallet at all, pick your network, and see every outstanding allowance: which contract, which token, and how much it’s allowed to take. Anything showing “Unlimited” to a contract you don’t recognize is a red flag.
- Etherscan’s Token Approval Checker — most major block explorers host an equivalent tool, which is handy when you want a second opinion from a source that isn’t a third-party site.
Remember that approvals are per chain, per token, per contract. If you’ve used Ethereum mainnet, Arbitrum, Base, and BNB Chain, you have four separate approval lists to inspect — the tool only shows one network at a time. Check every chain you’ve ever transacted on, including the ones you abandoned in 2021.
Both are read-only for inspection. You can audit any address — including ones you don’t own — which is useful for checking what a protocol’s contract holds permissions on.
Revoking: what it does and what it costs
Revoking means sending a new approve transaction with the amount set to zero. It’s an on-chain transaction, so it costs gas — cents on layer-2 networks, a few dollars on Ethereum mainnet in typical conditions. Prioritize: unlimited allowances to contracts you no longer use go first, anything unrecognized goes immediately. A few dollars of gas to close an unlimited line of credit is the best trade in security.
Unlimited vs. exact approvals
Most wallets now let you edit the spending cap before confirming — you can change the requested “unlimited” to exactly what this one trade needs, plus a small buffer. The trade-off is real: precise approvals mean a new approval transaction (and gas) next time. A sensible middle ground:
- Exact or small caps for new, experimental, or rarely-used apps.
- Unlimited reserved for top-tier, battle-tested contracts you use weekly, where repeat approval fees would genuinely add up.
The fake revoke-site trap
Drainer operators know that scared users search “revoke approvals,” so they run ads for lookalike revoke tools. The fake site asks you to connect your wallet and “sign to revoke” — and the signature you just gave is itself a malicious approval. Genuine checking requires no signature and no wallet connection at all; you paste an address and read. Only ever use revoke.cash from your own bookmark or a typed URL, never from an ad or a link someone sent you. This is the same playbook covered in our scam guide: urgency plus a link equals theft.
Standing hygiene, four habits
- Experiment from a separate hot wallet holding only what you’re willing to lose — see our wallet setup guide. Approvals can only reach the tokens in the wallet that signed them.
- Revoke when you’re done with an app, the same way you’d log out of a shared computer.
- Audit monthly. Put a recurring reminder; paste your addresses into revoke.cash; five minutes, done.
- Signed something suspicious? Revoke it first, then move remaining funds to a fresh wallet — the exact sequence is in our first-24-hours recovery guide.
Where to go next
Understand the enemy with the wallet drainer glossary entry, learn the patterns in how to spot crypto scams, and get the bigger picture of what these apps do in what is DeFi.
This guide is educational only and is not financial advice. Revoking approvals reduces risk; it cannot undo transactions already confirmed on-chain. Read our full disclaimer.