What is approval revocation?

The act of withdrawing a spending permission you previously granted a smart contract, so it can no longer move that token from your wallet.

Revocation is itself an on-chain transaction and costs a network fee, which is why many people leave old approvals in place for years after they stop using an application. Those stale permissions are a standing liability, since an exploit in a contract you abandoned still reaches your current balance.

The asymmetry is what catches people out. Granting an approval is bundled into a flow you wanted anyway, so it costs one extra confirmation. Revoking is a separate, deliberate, paid transaction that nothing prompts you to make.

How it works

The ERC-20 standard defines an approve function taking a spender address and an amount, and a matching allowance function that reports the current figure (source: EIP-20). Approving does not move tokens; it records that the named contract may move up to that amount on your behalf, at any time, until the figure changes.

Many applications request the maximum possible value so you never have to approve again. That is a permanent, unlimited claim on your balance of that token, held by that contract.

Revoking is calling approve again on the same token contract, with the same spender, and an amount of zero. There is no separate revoke function in the standard. That is why revocation costs a full transaction fee.

Approvals are per token and per spender, so one wallet can hold dozens. Explorers on major chains publish a token-approval page per address, and dedicated tools list live allowances across chains so you can see the whole set.

For erc 721 and erc 1155 collections the equivalent is setApprovalForAll, which is all-or-nothing for the entire collection and should be revoked the same way.

Example

Illustrative: two years ago you approved an unlimited allowance for a trading application and used it twice. Today you hold 3,000 USDC in that wallet. The application's contract is exploited. The attacker calls transferFrom against every address with a live allowance, and because your allowance is unlimited and your balance is 3,000 USDC, all 3,000 moves. Had you approved exactly the 200 USDC you needed at the time, the loss would have been capped at 200.

Why it matters when you buy

This only applies once you hold assets in your own wallet rather than on an exchange, which is exactly the step most buyers take after their first purchases. Before you leave a balance in a wallet that has ever touched an application, review the approval list on the chain's explorer and clear anything you no longer use. See the guide on verifying a token contract for the related checks.

Related terms

• token approval — the permission being withdrawn
• erc 20 — the standard that defines approve and allowance
• wallet drainer — the contracts that harvest approvals
• gas — what revocation costs you
• blind signing — approving what you cannot read
• transaction simulation — previewing what a signature grants

Questions

Does revoking cost money?

Yes. It is an ordinary transaction and pays the network fee of the chain it runs on. Batching several revocations when fees are low is cheaper than clearing them one at a time on a busy day.

Should I approve an exact amount instead of unlimited?

Approving the amount you need caps the loss if the contract is later exploited, at the cost of a new approval each time. Some wallets now offer this as a default setting.

Do approvals expire on their own?

Not under the base standard. Newer permit-style approvals can carry a deadline, but a plain ERC-20 allowance stays live until someone changes it.