How to check MetaMask token approvals? (Revoke Permissions)

Understanding Token Approvals in MetaMask

1. Token approvals are Ethereum-based permissions granted to smart contracts, allowing them to withdraw tokens from your wallet up to a specified amount.

2. These approvals persist across sessions and remain active until manually revoked, even if the associated dApp is no longer used.

3. Each approval is recorded on-chain as an ERC-20 allowance transaction, visible via blockchain explorers like Etherscan.

4. Users often overlook these permissions, creating potential risks if a compromised or malicious contract gains access to their token balance.

5. MetaMask itself does not display a built-in interface for managing approvals; external tools are required to view or revoke them.

Using Etherscan to Review Active Approvals

1. Navigate to https://etherscan.io/tokenapprovalchecker and connect your wallet using the “Connect Wallet” button.

2. Select MetaMask when prompted and approve the connection request—this action reads data only and does not sign any transaction.

3. The tool scans your address and lists all contracts with active allowances, including token name, spender address, and approved amount.

4. High-risk entries include approvals with unlimited allowances (e.g., “∞” or “999…”), especially for unfamiliar or outdated protocols.

5. Clicking on any listed spender reveals its transaction history, helping assess legitimacy and usage frequency.

Revoking Approvals via Revoke.cash

1. Go to https://revoke.cash, a trusted open-source platform designed specifically for ERC-20 permission management.

2. Connect your MetaMask wallet and confirm the read-only access prompt—no gas is required at this stage.

3. The dashboard displays all active approvals sorted by token, with filters for “Unlimited”, “High Allowance”, and “Unused”.

4. Locate the target contract, click “Revoke”, and confirm the transaction in MetaMask—this requires ETH for gas.

5. After confirmation, the status changes to “Revoked” and the on-chain allowance drops to zero, preventing further token transfers by that contract.

Risks of Unchecked Token Permissions

1. A single compromised dApp with broad token approval can drain your entire token balance without additional user interaction.

2. Phishing sites often trick users into approving malicious contracts under the guise of “connecting wallet” or “claiming rewards”.

3. Some DeFi aggregators request blanket approvals across multiple tokens, increasing exposure surface unnecessarily.

4. Old NFT marketplace approvals may still permit transfers of newly acquired ERC-20 tokens if allowances were set to infinite.

5. Contract upgrades or re-deployments sometimes retain old approval logic, meaning revoked permissions on prior versions may not apply to new ones.

Frequently Asked Questions

Q: Does revoking an approval affect staked tokens or LP positions?A: No. Revocation only removes transfer permission. Staked assets governed by separate smart contracts remain unaffected unless those contracts themselves require allowances for withdrawals or swaps.

Q: Can I revoke approvals for tokens on networks other than Ethereum Mainnet?A: Yes. Tools like Revoke.cash support BSC, Polygon, Arbitrum, Optimism, and Base. Ensure you switch MetaMask to the correct network before connecting.

Q: Why does MetaMask show “Connected” to a dApp but no token approvals appear?A: Connection status reflects wallet authentication only. Approvals occur separately during token interactions such as swapping or depositing—mere connection does not imply allowance.

Q: Is it safe to use third-party revoke tools?A: Revoke.cash and Etherscan’s Token Approval Checker are audited, front-end-only, and do not hold private keys or request signature approvals beyond standard Ethereum transactions.