How to revoke token approvals on MetaMask? (Phishing Protection)

Understanding Token Approval Risks

1. Every time a decentralized application requests permission to spend your tokens, MetaMask displays an approval transaction that grants indefinite access to a specific smart contract.

2. Malicious dApps may request approvals for high-value tokens like USDC, ETH, or WETH without clear disclosure of scope or duration.

3. Once approved, the contract can withdraw funds from your wallet at any time—even if you no longer interact with the site.

4. Historical incidents show attackers exploiting leftover approvals to drain wallets hours or weeks after initial interaction.

5. Revoking unused approvals is not optional maintenance—it is a critical hygiene practice comparable to changing passwords after a breach.

Manual Revocation via Etherscan

1. Navigate to etherscan.io and paste your wallet address into the search bar.

2. Click the Token Approvals tab located just below the address summary section.

3. Filter results by status: select Active to see only live, unrevoked permissions.

4. Identify suspicious or obsolete contracts—look for unfamiliar names, zero-transaction history, or protocols you haven’t used in over 30 days.

5. Click the Revoke button next to each entry, confirm the transaction in MetaMask, and wait for block confirmation.

Using Revoke.cash for Bulk Management

1. Visit revoke.cash and connect your MetaMask wallet using the browser extension prompt.

2. The interface automatically loads all active token allowances across Ethereum mainnet and supported Layer 2s.

3. Sort entries by token symbol or spender name to locate high-risk approvals such as those granted to unknown proxy contracts or flash loan aggregators.

4. Select multiple items using checkboxes and click Revoke Selected to initiate batch transactions.

5. Each revocation requires individual signature in MetaMask—do not skip verification of contract addresses before confirming.

Preventing Future Over-Approvals

1. Always inspect the spender address in MetaMask’s approval modal before clicking Confirm—verify it matches official documentation.

2. Avoid clicking “Approve All” buttons; instead opt for exact-amount approvals when interfaces support them.

3. Use wallet extensions like Rabby or Phantom that display real-time contract reputation scores beside approval prompts.

4. Disable auto-approval features in MetaMask settings and enforce manual review for every permission request.

5. Maintain a separate wallet for testing new dApps—never approve tokens from your primary savings address.

Frequently Asked Questions

Q: Does revoking an approval cost gas every time?Yes. Each revocation is an on-chain transaction and incurs network fees proportional to current congestion levels.

Q: Can I revoke approvals made on Polygon or Arbitrum using Etherscan?No. Etherscan only covers Ethereum mainnet. For other chains, use their native explorers—polygonscan.com, arbiscan.io—or multi-chain tools like revoke.cash.

Q: What happens if I revoke an approval needed by a staking protocol?You will lose the ability to unstake or claim rewards until you re-approve the exact same contract. Verify active usage before revoking.

Q: Are NFT approvals handled the same way as ERC-20 tokens?No. NFT approvals require separate inspection—check the NFT Approvals tab on Etherscan or use approvecheck.xyz for comprehensive coverage.