Decentralized apps let crypto holders swap tokens, lend assets and trade NFTs from their own wallets. To do this, many apps ask for a token approval. This is a permission that lets a smart contract spend a set amount of a token on the owner’s behalf.
Approvals are a normal part of how these apps work. But they can also put funds at risk if the contract that receives them is malicious or later gets hacked.
This article sets out the key numbers behind token approvals. It draws on official guidance from Ethereum.org, MetaMask, Coinbase, Etherscan and Revoke.cash.
Some figures in this piece are worked examples taken from that guidance. They show how approvals behave. They are not market data or current fee quotes.
Key Numbers at a Glance
The table below lists the main figures covered in this article. Each one is explained in the sections that follow.
| Measure | Figure |
|---|---|
| Maximum value of an ERC-20 allowance | 2^256 minus 1 (78 digits) |
| Automatic expiry date for standard approvals | None |
| Token standards covered by Etherscan’s checker | 3 (ERC-20, ERC-721, ERC-1155) |
| Networks listed for MetaMask Portfolio spending caps | 5 |
| Tools that can show approvals without a wallet connection | 2 of the 4 covered |
| Steps in the official revocation process | 10 |
| Example cost to revoke 8 approvals | $1.60 to $24 |
| NFTs exposed by a collection-wide approval (10-NFT example) | 10 of 10 |
| Common approval mistakes listed in guidance | 7 |
| Points on the approval security checklist | 12 |
Three themes run through these numbers. Approvals can be very large, they do not expire on their own, and removing them costs a small network fee.
Connecting a Wallet vs Approving Tokens
Token approvals are most common on Ethereum and on networks built to work like it. Many tokens follow a standard called ERC-20. This standard includes a built-in way to let another address spend tokens for the owner.
Official guidance lists five common uses for approvals. These are swapping tokens on decentralized exchanges, depositing into lending protocols, adding assets to liquidity pools, some types of staking and moving NFTs through marketplaces.
Here is a typical case. A user wants to swap $500 worth of USDC for ETH. Before the swap, the exchange asks for permission for its contract to spend the user’s USDC. The user signs an approval, and once it is confirmed, the contract can use that allowance.
Without that permission, the contract cannot normally move the tokens through the ERC-20 allowance system. MetaMask describes approvals as an ordinary part of using decentralized finance, but says users should review what they grant.
Many users treat connecting a wallet and approving tokens as the same thing. They are two different actions with different effects.
When a user connects a wallet, the website can usually see selected public addresses, balances and transaction history. It can also ask the user to sign transactions. A standard connection does not give the site permission to move tokens.
A token approval is different. It gives a specific address the right to spend a set amount of a token through that token’s contract. For ERC-20 tokens, this is recorded on the blockchain.
Of the seven features compared in official wallet guidance, a token approval is the only one of the two actions that directly authorizes spending. It is also the only one that needs an on-chain transaction and a gas fee.
The most important row is the one about disconnecting. A wallet connection generally ends when the user disconnects. A token approval stays active.
MetaMask warns that smart contracts can keep their spending rights after a website has been disconnected. Ethereum.org gives the same warning. Closing a browser tab, deleting a bookmark or removing a wallet app does not remove an approval.
Coinbase’s wallet guidance draws the same line. It says token allowances give spending power that goes beyond a normal wallet connection.
Tools for Checking Approvals
Users can review many of their existing approvals with only a public wallet address. On Ethereum, this address usually starts with “0x.” No private key, recovery phrase or password is needed to look.
Four widely used options are covered in official guidance. Two of them, Revoke.cash and the Etherscan Token Approval Checker, let users view approvals without connecting a wallet at all.
Each tool has a different reach. Revoke.cash supports many blockchain networks. Etherscan’s checker covers Ethereum and sorts approvals into three token standards: ERC-20, ERC-721 and ERC-1155.
MetaMask Portfolio lists five supported networks for its spending cap tool: Ethereum Mainnet, Polygon, BNB Chain, Optimism and Base. MetaMask advises users to confirm the latest list before relying on it for a full review.
Coinbase Wallet has a Token Approvals section inside the wallet settings. Coinbase notes that menus can differ between wallet versions.
The steps to check approvals are short. The table below shows the number of steps in each official process.
| Method | Steps in official guide | Wallet connection needed to view? |
|---|---|---|
| Revoke.cash | 6 | No |
| Etherscan Token Approval Checker | 7 | No |
| MetaMask Portfolio spending caps | 6 | Yes |
| Full revocation process (any trusted tool) | 10 | Only at the revoke step |
Approvals are stored per network. An approval on Ethereum will not show up when checking Base, Polygon or Arbitrum. A user active on four networks needs four separate checks.
Users should go to these tools directly rather than through links in emails, direct messages or social media ads. Security guidance warns that fake sites sometimes copy well-known security services.
Users should also not assume an approval is safe because the token name looks familiar. A real token can still be approved for spending by a malicious contract, so the spender address is what matters.
These tools also have limits. They show approvals already recorded on the blockchain. They may not show signed messages that have not yet been submitted, which is covered later in this article.
How Large Is an Unlimited Approval?
Many apps ask for an “unlimited” approval. This saves the user from approving a new amount before every trade. It also means the contract can spend far more than the user meant to use.
ERC-20 contracts often record an unlimited allowance as the largest number the contract can store. That number is 2 to the power of 256, minus 1. It has 78 digits and is roughly 1.16 times 10 to the 77th power.
In practice, the cap is the user’s full balance of that token. The large number simply means the allowance will not run out.
The chart uses a log scale, where each step is ten times larger than the last. Even so, the example amounts of 100, 1,000 and 20,900 USDC barely register next to the maximum value.
The figure is a raw contract value, not a dollar amount. Tokens such as USDC store balances in small base units. Either way, the result is the same. An unlimited approval covers every unit of that token the wallet holds now or later.
Ethereum.org calls unlimited approvals a serious risk. The reason is that they can stay active long after the trade they were meant for has ended.
How Old Approvals Can Reach New Funds
Ethereum.org says ordinary token approvals have no automatic expiry date. They can stay usable for years after being granted.
The guidance uses a simple example. An investor holds 1,000 USDC and grants an unlimited approval to an exchange contract. They then swap 100 USDC.
After the swap, the contract can still reach the remaining 900 USDC. Months later, the investor adds 20,000 USDC to the same wallet. The old approval now covers 20,900 USDC.
If the investor had approved only 100 USDC, the allowance would have been used up by the swap. The contract would have had access to zero USDC afterward.
The trade-off is cost and time. A limited approval may mean paying gas for a new approval before each trade. For unfamiliar apps, the guidance says limiting permissions is generally the safer choice.
Not every approval carries the same risk. The guidance lists eight factors that help users judge how much exposure an approval creates.
| Risk factor | Lower risk | Higher risk |
|---|---|---|
| Spender identity | Independently verified contract | Unknown or misleading address |
| Approval amount | Limited allowance | Unlimited allowance |
| Protocol history | Established track record | Recently launched project |
| Contract security | Publicly reviewed code | Unverified or hidden code |
| Admin control | Limited and open | Wide special permissions |
| Recent use | Still needed | No longer needed |
| Token value | Small exposure | Large holdings |
| Security incidents | No known open issue | Recent exploit or warning |
These are signs, not guarantees. Well-known protocols can still have flaws, and new projects are not automatically scams.
The guidance suggests one key question. If the approved contract were hacked tomorrow, how much crypto could it move?
NFT Approvals and Collection-Wide Risk
Approvals are not limited to tokens like USDC. NFTs use permission systems too.
The ERC-721 standard lets an owner approve the transfer of one specific NFT. It also allows a wider “operator” approval, often granted through a function called setApprovalForAll. The ERC-1155 standard supports permissions for groups of assets.
The difference in exposure can be large. Consider an investor who owns 10 NFTs from one collection.
A single NFT approval puts 1 of the 10 NFTs within reach of the approved address. A collection-wide approval puts all 10 within reach.
Coinbase warns that collection-wide approvals can expose every NFT they cover. Etherscan’s checker lists ERC-721 and ERC-1155 approvals next to ERC-20 approvals, so all three can be reviewed in one place.
Some NFT marketplace listings need an operator approval to stay active. Users should check whether a listing depends on an approval before removing it.
What It Costs to Revoke Approvals
Revoking an approval removes or lowers the allowance. For ERC-20 tokens, this usually means setting the allowance to zero.
The change must be made on the blockchain. That means a network fee, also called gas, applies each time.
The official process has 10 steps. They are: open a trusted checker, search the address, pick the network, find the approval, connect the wallet, choose revoke, review the transaction, confirm and pay gas, wait for confirmation and refresh the checker to verify.
Fees depend on the network and how busy it is. Ethereum Mainnet can be costly when demand is high. Layer 2 networks such as Base and Arbitrum generally cost less, but their fees are not fixed either.
The guidance gives an example with eight unused approvals. The chart shows the total cost at two example fee levels.
At $0.20 per transaction, removing all eight approvals would cost $1.60. At $3 per transaction, the total would be $24.
These are example numbers, not current fees. Users should check the estimated fee before confirming each transaction. Some services can batch several revocations together, though this is not available everywhere and extra charges may apply.
Revoking does not usually pull funds out of lending or staking positions. Revoke.cash says existing deposits generally stay in place. Future deposits may need a new approval.
Revoking also cannot undo past transfers. It only stops future spending through that allowance.
How Often to Check, and Where Tools Fall Short
There is no required schedule for reviewing approvals. The right pace depends on how often a person uses decentralized apps.
For people who rarely use these apps, the guidance suggests a monthly or quarterly review. That works out to 12 or 4 checks a year.
Active users who swap tokens or use new protocols often may need to check more often. A review after each unfamiliar app helps catch approvals before they build up.
Two events call for an immediate check. The first is when an app reports a security flaw. The second is before moving a large balance into a wallet that has used decentralized apps before, since an old unlimited approval may cover the new funds.
Checking tools only show approvals already on the blockchain. Some permissions work through signed messages instead. Examples include ERC-2612 permits and a system called Permit2.
These signatures may not cost gas when signed. That leads some users to think they are harmless. But a signed message can still give another party the right to spend tokens.
Signed permits may stay off the blockchain until someone submits them. Until then, they may not appear in a standard approval list. Some tools offer extra permit tracking, but coverage varies.
Hardware wallets have a limit too. They keep private keys on a separate device, which helps guard against key theft. Revoke.cash notes they cannot stop a contract from using an approval the user already signed.
The guidance suggests using separate wallets. One wallet can be used for testing new apps. A hardware wallet account can hold long-term savings and avoid granting contract permissions.
What to Do After a Suspicious Approval
If a user has approved a contract they do not trust, the guidance lists a set of steps. The first is to revoke the approval through a trusted tool and confirm the transaction went through.
Next, users should check every network the wallet has used, review recent transfers and save the transaction hashes. They should also disconnect suspicious websites, while keeping in mind that disconnecting does not revoke anything.
If the recovery phrase or private key may have been exposed, revoking approvals is not enough. An attacker with the key can sign new transactions. Ethereum.org advises moving any remaining funds to a new, secure wallet.
Users should also watch for recovery scams. Ethereum.org warns that fraudsters often pose as security experts and offer to recover stolen crypto. No one needs a recovery phrase to help, and completed blockchain transfers generally cannot be reversed.
The guidance also names seven common mistakes. These are approving unlimited amounts by default, treating disconnecting as revoking, ignoring old approvals, trusting familiar token names, assuming hardware wallets stop all scams, overlooking NFT operator approvals and treating checkers as guarantees.
To avoid these, the guidance offers a 12-point checklist. The chart groups the points by when they apply.
| Security check | Recommended action |
|---|---|
| Public wallet address | Review existing approvals without signing |
| Website | Verify the official domain |
| Spender | Confirm the smart contract address |
| Token allowance | Avoid unlimited approvals you do not need |
| Existing permissions | Revoke contracts no longer used |
| NFT operator approvals | Check collection-wide approvals |
| Blockchain coverage | Review every network used |
| Signature requests | Read permit and transaction details |
| Hardware wallet | Know that approved spending is still possible |
| Long-term holdings | Keep savings apart from app activity |
| Suspicious activity | Investigate right away |
| Recovery phrase | Never share it with apps or support agents |
The guidance boils this down to a short routine. Verify the website and contract, check existing approvals, connect only the account needed and read every request before confirming.
The core rule across all sources is the same. Give contracts only the access they need, remove it when it is no longer needed and do not sign anything you do not understand.
This article is for information only and is not financial, investment or legal advice. Crypto transactions can be irreversible.
Sources
- Ethereum.org: How to Revoke Smart Contract Access to Your Crypto Funds
- MetaMask: How to Revoke Smart Contract Allowances and Token Approvals
- Etherscan: Token Approvals
- Revoke.cash: How to Revoke Token Approvals
- Coinbase: Manage dApp Permissions and Token Approvals
- MetaMask: How to Manage Spending Caps
- Revoke.cash: Frequently Asked Questions
- Ethereum.org: Scam Help and Reporting
