Token Approvals: The Permission You Forgot You Gave

An ERC-20 token does not live in your wallet in the way a coin lives in a pocket. The token contract keeps a ledger, and your wallet is an entry in it. For any other contract to move your balance, you have to write permission into that ledger. That is an approval.

What you are actually agreeing to

Three things at once, and the confirmation screen usually emphasises none of them. Which contract may spend. Which token it may spend. And how much – which by convention is the largest number the standard allows, because asking once is cheaper than asking on every trade.

There is no expiry in the standard. Approve a contract to spend your USDC in March and, unless you revoke it, that permission is live in December.

How this turns into a loss

1. You trade on a new site, granting it unlimited approval for a token you hold.
2. The trade completes. You move on and the approval remains.
3. Later, that contract is exploited, upgraded by a malicious owner, or was designed for this from the beginning.
4. It calls the token contract and moves your balance. You are not prompted, because you already agreed.
5. The first you know is the balance being gone.

Nothing in that sequence requires you to have made a mistake at any point after step one. That is what makes it worth a periodic clear-out rather than more care in the moment.

How to check and revoke

1. Open Revoke.cash, connect the address in read-only mode and let it list every live approval.
2. Sort by what the approval covers. Anything unlimited on a token you hold in size comes first.
3. Revoke what you no longer use. Each one is a transaction and costs a little gas.
4. Repeat for every address you trade from. Approvals are per wallet, not per person.
5. Some wallets, Rabby among them, show the same list without a separate site.

How often is enough

After any session in which you interacted with contracts you had not used before, which for an active memecoin trader is most sessions. A monthly pass is a reasonable floor for everyone else. The cost is a few cents of gas per approval on an L2, which is one of the better security trades available.

What revoking does not fix

• It does not undo a transfer that already happened. Revoking is prevention, not recovery.
• It does not help if your seed phrase is compromised – at that point permissions are irrelevant.
• It does not cover signatures such as Permit, which authorise spending without an onchain approval. Those are worth reading carefully at signing time.
• It does not make a malicious token safe. Some tokens are hostile in their own transfer logic, whoever is approved.

The habit that prevents most of it

Trade from a wallet that does not hold anything you would miss. An unlimited approval on an empty wallet is an unlimited claim on nothing, and no amount of approval hygiene beats simply not having the balance exposed in the first place.