Token approvals: how to review and revoke them

What you will achieve and what you need before you start

By the end you will know which permissions may have been granted when you used your wallet with a dApp (decentralised application), you will be able to review them, and you will remove the ones you no longer use. Take it steadily and in order: a step done in a hurry is exactly what tends to cost money here.

Before you go on, have the following to hand:

A self-custody wallet that you have already connected to a dApp.
Some balance on the relevant network to pay for gas (the network fee). Revoking a permission is a transaction, and both approving and revoking on Ethereum require gas, according to the OpenSea Help Center and the MetaMask Help Center.
A little time without distractions.

A note on where the steps come from: they are taken from the official MetaMask and OpenSea documentation, not from my own testing. Interfaces change, so I explain the reason for each step, which is what stays the same. If the basics are still unclear, start with the guide to blockchain and cryptocurrencies from scratch.

What an approval is and what a message signature is

According to OpenSea, all dApps need permission from non-custodial wallets before they can interact with the tokens held in them. That permission is the token approval. MetaMask calls it a “spending cap” and notes that it is also known as a token approval or allowance.

The features you should know about:

It is recorded on the blockchain. Once the transaction is signed, its existence is recorded and it remains valid until you sign another one that revokes it (MetaMask).
It can be spent in several goes. If you sign a cap of 1000 USDC (a stablecoin, that is, a token designed to hold a stable value), the dApp can use up to 1000 USDC in one transaction or in many; the permission is valid until that amount is used up (MetaMask).
It is usually requested without a limit. By default, most dApps request an unlimited spending cap (OpenSea). With an approval like that, a malicious actor could drain your funds in ERC-20 tokens, Ethereum’s standard for fungible (interchangeable) tokens.

The sources consulted do not specify exactly what is granted merely by connecting your wallet. What they do document are the two mechanisms that give permission over your tokens: the approval recorded on-chain and, as you will see shortly, a message signature.

The message signature that acts as an approval

A message signature is not sent to the network as a transaction and does not pay gas at that moment. Even so, it can have the same effect as an approval. The ERC-2612 standard (“Final” status, created on 13 April 2020) adds a function called permit to the EIP-20 token standard. With it, the allowance is changed by means of a signed message, rather than by a transaction sent by the owner. The signed data follows the EIP-712 format.

A permit message includes these fields: owner, spender, value, nonce and deadline. The domain adds name, version, chainId and verifyingContract. For you, the practical reading is this: who spends (spender) and how much (value).

On the deadline, a cautious reading, not a fact from the sources: going by its name, it looks like a time limit attached to the signature, and it is not clear that it equals the duration of the permission. The sources consulted only list the field, without detailing its effect. Do not assume that a deadline guarantees the permission will end by itself.

Why a gasless signature can also cost you your funds

An analysis by DARKNAVY dated 16 March 2026 documents a theft of USDC by means of permit. The victim only saw a MetaMask “Sign” dialogue, not a transaction confirmation, something many users consider less serious.

What happened next, according to the analysis:

The permit was signed with value and deadline set to the maximum possible value (type(uint256).max). The approval was permanent and covered the whole balance indefinitely.
The signature was collected off-chain, so the victim had no on-chain sign that their funds were at risk until the drain was executed.
The attacker executed a permit that granted them unlimited USDC approval, followed by three transferFrom calls (the function that moves tokens on behalf of their owner) launched through a contract called Multicall3. The victim sent no on-chain approval.

My opinion, kept apart from the facts: treat every “Sign” window with the same attention as a transaction. Read what you are signing, for whom and for how much. The absence of gas does not mean the absence of consequences.

Permit2: an in-between case worth recognising

According to L2BEAT, Permit2 (address 0x000000000022D473030F116dDEE9F6B43aC78BA3) is a signature-based token approval hub. You grant one ERC-20 approval per token to that hub and then authorise specific spenders through signed permits, limited in time and amount, and revocable with “lockdown”. Any spender with a valid permit can withdraw the permitted amount.

This means checking two levels: the approval to the hub and the signed permissions beneath it. The sources consulted mention lockdown, but do not detail how to view or revoke those permits with the tools I describe below, so I am not going to invent a procedure. If you want to understand what a protocol like the one in that source does, read the guide to decentralised finance and its risks before using it.

How to review and revoke your approvals, step by step

A warning before the first step: Etherscan’s revocation tools are third-party. OpenSea warns that it cannot guarantee their service. And revocation is a real transaction: you pay gas and it must be confirmed.

The diagram summarises who can move what. A spender can obtain permission through an approval recorded on-chain or through a permit signed off-chain. On-chain revocation acts on recorded approvals; as for signed permits, the sources only mention Permit2’s lockdown, without detailing the procedure.

A spender can obtain permission through an on-chain approval or through a permit signed off-chain. On-chain revocation acts on recorded approvals.

Route A: MetaMask Portfolio

As of October 2026, according to the MetaMask Help Center, it works on Ethereum Mainnet, Polygon, BNB Chain, Optimism and Base. That list may change, so check it against the official help pages.

Open MetaMask Portfolio with your wallet connected. A precaution of mine: check that the connected wallet is the one you want to review, so that you do not act on another one by mistake.
Under “Overview”, go to the “Spending Caps” tab.
Click the revoke button next to the cap you want to remove.
Check the network and send the transaction from MetaMask. You need gas on that network for it to be executed.

Route B: Etherscan’s Token Approval tool

This is the one used in OpenSea’s tutorial. I cite it because of that documentation, not as a recommendation: it is a third party, and it is worth understanding what you sign when you connect.

Connect your wallet with “Connect to Web3”.
Go through the ERC-20, ERC-721 and ERC-1155 tabs until you find the approval you want to remove.
Click “Revoke”.
Confirm the request in your wallet, after checking the network and the fee.

Limiting the permission from the start

When a dApp asks you to approve spending in MetaMask, you can click “Edit Permission” and enter an amount under “Custom Spend Limit”. According to OpenSea, setting a limit reduces the risk of a malicious actor draining your ERC-20 funds.

With NFTs (non-fungible tokens, that is, unique ones), revoking means that the NFT cannot be bought, sold or transferred through OpenSea without approving again (OpenSea). Revoke what you no longer use, knowing that if you trade again later you will have to approve again.

Mistakes that cost money

Accepting the unlimited amount by default. If you can set a limit, set it.
Treating a gasless “Sign” as harmless. The DARKNAVY case shows otherwise.
Believing an approval expires by itself. According to MetaMask, a recorded approval is valid until it is used up or you sign another that revokes it. In the case analysed, moreover, neither the amount nor the signature’s time limit had a cap.
Revoking in a hurry. The wrong network, or a wallet without gas, leaves the revocation undone. Before sending, check the network and the fee.
Trusting a third-party tool blindly. OpenSea warns that it does not guarantee their service.
Expecting revocation to recover funds. This is my own judgement: revocation closes the door going forward; it does not bring back what has already been moved.

Check that it worked

Go back to the “Spending Caps” tab in MetaMask Portfolio, or to the ERC-20, ERC-721 and ERC-1155 tabs of Etherscan’s tool, and check that the approval no longer appears.
Copy the ID of the revocation transaction and open it in the network’s block explorer. It should appear as confirmed; revocation is a transaction, according to MetaMask.

A warning so you are not left with false reassurance: those lists show approvals recorded on-chain. According to DARKNAVY, a permit signature collected off-chain leaves no sign until it is executed. An empty list therefore does not prove that no signatures remain outstanding. The sources consulted do not detail how to cancel them with these tools, so I am not proposing any procedure.

Next step

Repeat the review on each network in MetaMask’s list where you have used your wallet. And if you are going to keep connecting to applications, go through how to start using Web3 safely to put your habits in order before you sign again.

Sources

Image: geralt on Pixabay

Translated and adapted by Ollie.

Token approvals: what you sign when you connect your wallet, and how to revoke them