Token Approvals and Revoke: Allowance vs Permit
Leaving a dApp does not remove its token allowance. Check the chain, token and spender before deciding what to revoke. Disconnecting a site changes no on-chain allowance, and a Permit signature you already shared needs a separate check of its expiry and nonce.
What a token approval actually grants
Read the owner, spender and allowance on the correct token contract and chain. A spender may be a contract or an ordinary address. Standard ERC-20 allowances can persist until consumed or changed and have no universal expiry.
One token's allowance does not cover every asset or the native coin. NFT permissions can cover a single token ID or an operator for an entire collection, depending on the call.
What unlimited approval exposes
Some apps request large allowances to reduce repeat approvals. That exposes more of the token, including later deposits, if the spender can abuse it. Limiting the amount does not make a malicious spender safe. A contract's ability to use an allowance also depends on its code and call conditions.
How an approval becomes a theft
- A phishing page substitutes the attacker's spender in an approval request.
- An exploitable contract provides a path to use previously granted allowances.
- A standing allowance is used again, including against later token deposits.
Inspect the permission rather than trusting a button labelled “claim” or “login.” The phishing guide explains those lures.
How to see what your wallet has approved
- Open the verified Revoke.cash site or chain explorer. Entering a public address permits read-only inspection without sharing a key.
- Select each chain you used. Check tokens, spenders, allowances and NFT operators. Coverage varies; an empty list is not a security certificate.
- Compare addresses with official protocol documentation and transaction history. An unfamiliar label needs investigation and does not by itself prove phishing.
How to revoke an approval
ERC-20 revocation normally sets the spender's allowance to zero; revoking a collection operator normally sets approval to false. Inspect the chain, contract and call in your wallet, confirm it is a revocation, then wait for a successful receipt and query the permission again.
Budget from the current wallet fee estimate. Quiet hours and batching do not guarantee savings, and different chains cannot necessarily share one transaction. A genuine tool URL reduces impersonation risk but does not replace checking the request. Read-only inspection needs no seed phrase; revocation is signed inside your own wallet.
Approve vs Permit: off-chain signatures have limits too
EIP-2612 Permit lets an owner sign fields including spender, value, nonce and deadline before someone pays gas to submit the permission. Signing itself does not transfer tokens. An unused signature may be absent from ordinary allowance lists.
A signature is constrained by its deadline, nonce, chain and contract domain, rather than usable at literally any time. Clearing the current allowance may leave an unused Permit valid; nonce handling depends on the implementation. Permit2 distinguishes standing allowances from single-use signature transfers. Underlying token approval, Permit2 permissions and signature nonces are separate controls.
After a suspicious signature, preserve its fields and check permission state. Revocation, nonce invalidation and moving affected assets have different costs and timing. If a key leaked, allowance cleanup cannot restore exclusive control; use an independent new key in a trusted environment.
Approval self-audit checklist
- [ ] Check every used chain, token, spender and allowance
- [ ] Remove unused permissions, wait for success and query again
- [ ] Check suspicious off-chain signatures separately: deadline, nonce and implementation
- [ ] Separate long-term and routine assets with key and device risks in mind
- [ ] Cancel requests you cannot interpret, including gas-free signatures
FAQ · five approval questions
Does revoking an approval cost money?
Yes. Use the current wallet fee estimate, not a fixed cents-per-revoke claim or a promise that batching saves money.
Is it safe to revoke approvals with a block explorer or revoke.cash?
Verify the site and coverage, then inspect the chain, contract and revocation call. A genuine site is not a reason to sign blindly. Read-only address searches need no seed phrase.
Why do dApps keep asking for unlimited approval?
Large allowances can reduce repeat approvals but expose more of that token. Limiting the amount still requires checking the spender.
If I revoke, can I get back funds that were already stolen?
No. Revocation affects future permissions, not completed transfers. A leaked key also requires protecting remaining assets and retiring the compromised key.
What is the difference between Approve and a Permit signature, and does revoking work on both?
Approve sets an allowance on-chain. Permit can be signed before submission and is constrained by nonce, deadline and contract domain. Clearing an allowance may not invalidate an unused signature; follow the implementation.
Sources cited
- ERC-20 approve/allowance standard · eips.ethereum.org/EIPS/eip-20
- EIP-2612 Permit standard · eips.ethereum.org/EIPS/eip-2612
- revoke.cash open-source code and docs · github.com/RevokeCash/revoke.cash
- SlowMist security incident archive · slowmist.com
- Etherscan Token Approvals checker · etherscan.io/tokenapprovalchecker