Token Approvals: Disconnecting a Wallet Does Not Revoke Permission

Disconnecting a dApp does not normally revoke the token approvals already recorded on-chain. A website can disappear from your wallet’s connection list while its smart contract still has permission to move specified tokens or NFTs.

My judgment: review and revoke unused, unlimited or suspicious approvals from operational wallets. Do not revoke everything blindly: an active exchange, lending, staking or marketplace workflow may require a legitimate approval. Long-term savings should use a separate wallet that rarely grants any contract permission.

How to revoke token approvals: quick answer

1. Confirm the blockchain and wallet address you want to inspect.
2. Open a reputable token approval checker, block explorer or the wallet’s built-in approval manager.
3. Review the spender contract, token or NFT collection, allowance amount and last-used context.
4. Revoke approvals that are unknown, unlimited, no longer needed or connected to a compromised protocol.
5. Read the transaction on your wallet or hardware signer before confirming.
6. Pay the network gas fee and wait for confirmation.
7. Refresh the checker and verify that the allowance or operator permission changed.

Revocation is a new on-chain transaction. It cannot recover assets already transferred, and it does not make an unsafe wallet safe when the seed phrase or private key has been exposed.

What is a token approval?

A token approval is permission for a smart contract or another address—the spender—to move particular assets from your wallet under defined rules.

On Ethereum and other EVM networks, common approval models include:

• ERC-20 allowance: permission to transfer up to a specified quantity of a fungible token.
• ERC-721 approval: permission involving one NFT or an operator allowed to manage all NFTs in a collection.
• ERC-1155 operator approval: permission to manage supported multi-token assets for the owner.

Approvals are necessary because a decentralised exchange, lending protocol or NFT marketplace may need to move an asset as part of a transaction. The approval does not automatically give the contract your private key. It gives the contract a capability recognised by the token contract.

Disconnecting a wallet vs revoking an approval

This distinction explains why a dApp may no longer appear connected while its spender contract remains visible in Etherscan, a wallet approval manager or another chain-specific checker.

Why unlimited approvals are common—and risky

An interface may request an unlimited token approval so the user does not need to submit a new approval before every future trade or deposit. That reduces friction and repeated gas costs.

The risk is duration and scope. If the spender contract is malicious, upgraded unsafely or later exploited, a large active allowance may let it transfer the approved token without another approval transaction from the owner.

An unlimited approval for one ERC-20 token does not automatically grant access to every asset in the wallet. Permissions are normally specific to a token contract and spender. NFT operator approvals can be broader within the relevant collection. The exact permission shown on the signer matters.

How to check existing token approvals safely

1. Identify the correct chain

Approvals are chain-specific. An approval on Ethereum mainnet is not the same record as an approval on Arbitrum, Base, Polygon or BNB Smart Chain. Check every network on which the wallet has interacted with dApps.

2. Use a reputable approval tool

Suitable options include:

• a recognised block explorer’s token approval checker, such as Etherscan for Ethereum;
• a wallet’s official approval-management interface;
• a widely used open-source approval checker reached through its verified domain.

Do not choose a revocation site from a search advertisement or an unsolicited message. A fake “revoke” page can ask you to sign a new malicious approval instead.

3. Inspect the spender, not only the dApp name

Record the spender contract address, token contract, allowance amount and network. A familiar brand label is useful but not proof. Compare the address with the protocol’s official documentation or a reputable explorer label.

4. Separate unused from active approvals

An old allowance for a protocol you no longer use is a stronger revocation candidate than a limited approval required by a current position. Unknown spenders, contracts connected to an exploit, and unlimited allowances deserve priority.

How to revoke token approvals step by step

1. Open the official checker. Confirm the domain and network.
2. Connect the correct operational wallet. A public-address-only view may be enough to inspect approvals; signing is required only when submitting the revocation.
3. Select the approval. Verify the token, spender contract and allowance.
4. Choose revoke or set the allowance to zero. The exact interface depends on the token and tool.
5. Review the on-chain transaction. Confirm the network, contract address and function on the wallet or hardware signer.
6. Pay the gas fee. Revocation changes blockchain state and therefore normally costs the network’s native asset.
7. Wait for confirmation. Do not assume a submitted transaction succeeded.
8. Refresh the approval checker. Confirm that the allowance is zero or the operator permission is disabled.

Repeat the process on each relevant chain. Revoking on Ethereum does not clear a separate permission on another EVM network.

Does revoking token approvals cost gas?

Usually yes. A revocation is an on-chain transaction that updates the token contract’s allowance or operator state. The wallet needs enough native network currency—such as ETH on Ethereum—to pay the fee.

The fee depends on network conditions, the contract and the chain. Do not approve an opaque “gasless revocation” merely because it appears cheaper. Some systems legitimately use signatures or relayers, but the signed message still requires careful review.

Should you revoke all token approvals?

No universal rule requires every approval to be zero at all times. Blindly revoking everything can interrupt legitimate workflows and create repeated gas costs when approvals must be granted again.

Prioritise revocation when:

• you no longer use the dApp;
• the spender contract is unknown;
• the approval is unlimited but the intended activity was small;
• the protocol, front end or contract has been reported compromised;
• you approved through a suspicious or fake interface;
• the NFT collection or token no longer needs operator access;
• you are retiring the wallet from active Web3 use.

Keep a legitimate approval only when you understand the spender, still need the workflow and accept the contract risk.

What happens if you revoke an approval that is still in use?

Revocation usually removes future spending permission. It does not necessarily withdraw an existing lending deposit, liquidity position or staked balance. However, the protocol may be unable to perform a later action until you approve again.

Position mechanics differ. Before revoking an unfamiliar contract, identify whether the approval is used for deposits, withdrawals, automated position management, NFT listings or another function. Revocation is safer when based on a known relationship rather than a label alone.

Can revoking an approval stop a wallet drain?

It can remove an unused permission before an attacker uses it, but timing matters. If a malicious spender has already transferred the approved tokens, revocation cannot reverse the blockchain transaction.

When a malicious approval may be active:

1. stop interacting with the suspicious website;
2. inspect approvals through a trusted independent tool;
3. revoke the malicious spender when it is safe to do so;
4. move remaining valuable assets to a genuinely new wallet if the seed phrase or private key may also be compromised;
5. preserve transaction hashes and evidence.

A new wallet is required when the key itself is exposed. Approval hygiene cannot repair a stolen seed phrase.

Why a hardware wallet cannot undo an approved mistake

A hardware signer prevents ordinary software from silently extracting the private key. It also provides a separate place to review supported transaction details.

When the owner authorises a token allowance or NFT operator permission, the hardware wallet has performed its job: it signed the instruction after approval. The permission then exists on-chain. Locking, disconnecting or replacing the device does not remove it.

This is why key isolation and permission hygiene solve different failures. The strongest hardware wallet cannot make an unlimited approval harmless after it has been deliberately signed.

Approvals, permits and signed messages

Some applications use signed permits or order messages to reduce approval transactions. The user may sign data that can later be submitted on-chain under defined limits, nonces or expiry conditions.

Do not assume that setting an ordinary allowance to zero cancels every previously signed order or permit. Follow the protocol’s official cancellation process and review expiration, nonce and spender details. Treat unreadable signatures as transaction-level risk, even when no gas fee is requested at the moment of signing.

Token approvals on Solana and other non-EVM chains

The ERC-20, ERC-721 and ERC-1155 models discussed above apply to Ethereum-compatible systems. Other blockchains use different token accounts, delegate authorities and permission structures.

Use the official wallet or chain-specific documentation for Solana and other non-EVM networks. Do not assume an Ethereum approval checker can inspect or revoke permissions on a different architecture.

Approval hygiene checklist

• Use a separate operational or burner wallet for new dApps.
• Keep long-term savings in a wallet that rarely connects to contracts.
• Prefer exact or limited allowances when the interface supports them.
• Read the spender, token, amount and network on the signer.
• Review active approvals after mints, airdrops, campaigns and unfamiliar interactions.
• Revoke permissions connected to abandoned or compromised protocols.
• Bookmark official tools rather than searching during an incident.
• Never enter a seed phrase into a revocation website.

How often should you review approvals?

Review them after any high-risk or unfamiliar interaction and whenever a protocol reports a security incident. For an active DeFi or NFT wallet, a periodic review—such as monthly—can reveal forgotten permissions. A savings wallet should ideally have few or no approvals to review.

The correct frequency follows activity. A wallet that signed ten new contracts this week needs attention sooner than a wallet that has remained offline for months.

Final answer

Token approvals are durable on-chain permissions. Disconnecting a dApp removes an interface connection; revoking changes the permission itself.

Use a verified approval checker, confirm the correct chain and spender, revoke unused or risky permissions, pay the required gas fee and verify the result after confirmation. Do not revoke blindly, and do not mistake revocation for a remedy when the private key or recovery phrase has been exposed.

For the wider wallet structure, read Hot Wallet vs Cold Wallet, Can a Hardware Wallet Be Hacked? and hardware wallet setup guide.

Primary sources

• Ethereum.org: how to revoke smart-contract access
• MetaMask: revoke allowances and token approvals
• ERC-20 token standard
• ERC-2612 permit extension
• ERC-721 NFT approval interface
• ERC-1155 multi-token approval interface

No affiliate link is used in this article.