How to Revoke Token Approvals

When you trade on Uniswap or lend on Aave, you do not hand the app your coins. You sign an approval - a standing permission that lets that contract move one particular token out of your wallet. The permission stays live long after the trade is done, often with no cap on the amount, and it is still there months later. Revoking is the act of switching an old permission back off, and it takes one small transaction.

Why an old approval matters

It is a spare key you handed over and never asked back. Most of the time the holder is a well-audited contract and nothing happens. But if that contract turns out to have a bug, or the "app" you approved was a convincing fake in the first place, whoever controls it can pull the approved token out of your wallet at any moment without asking you again. Several of the largest wallet-draining incidents were old approvals being used, not private keys being stolen.

How to see and cancel yours

Use a revocation tool - revoke.cash is the best known, and Etherscan has a Token Approvals tab that does the same job. Connect the wallet, read the list, and work down it:

• Unlimited allowances on tokens you hold real value in, stablecoins such as USDC and Tether's USDT above all.
• Blanket NFT permissions, the kind that cover an entire collection rather than one item.
• Anything unfamiliar, or any app you used once and will not open again.

Press revoke, confirm in MetaMask, pay the network fee. Nothing else in the wallet is touched, and you can always approve again when you genuinely use the app.

Keeping the list short

When a wallet offers the choice, approve the amount you are actually trading instead of accepting the unlimited default. Keep the bulk of your holdings on a separate address that never signs anything. Then walk the list every few months - a diary entry, not an emergency.

Do it once today for the wallet you browse with; five minutes covers it. Related reading: how phishing collects those signatures and protecting an ENS name.