How to review and revoke token approvals without confusing them with wallet connections
Contents
TL;DR At a glance
Check the network, token and spending permission before revoking access. Learn why disconnecting a dapp is insufficient and when a compromised seed phrase changes the response.
Identify which permission you granted
Disconnecting a wallet from a website does not cancel a smart contract's existing permission to spend tokens. Ethereum.org distinguishes the website connection from the allowance recorded on the network. An old permission can therefore matter even when you no longer use the app.
Start with the wallet address and the network involved. A review on Ethereum does not automatically cover permissions on another chain. Use a tool linked from the official Ethereum.org or ENS guidance, rather than a link sent by someone claiming to offer support. You should not need to disclose your recovery phrase to inspect an approval.
Review the approval before signing
Use a deliberate sequence rather than approving every prompt:
- Match the wallet and network to the assets you intend to check.
- Read the token, the contract allowed to spend it and the permitted amount.
- For an NFT collection, check whether the permission covers every item through setApprovalForAll.
- Select the unwanted approval and inspect the revocation transaction in your wallet before signing.
- After confirmation, refresh the tool and check that the permission has been removed.
Revocation is an on-chain transaction and normally needs a network fee. A pending request is not the same as a confirmed change. If the transaction fails, do not assume the permission has disappeared.
Know what revocation cannot repair
ENS guidance draws an important boundary: revoking permission does not reverse transfers that already happened. It also cannot secure an address whose recovery phrase has been exposed, because someone with that phrase can control the wallet and grant permissions again.
Treat a leaked phrase as a separate compromise requiring a new wallet with a fresh phrase. Do not keep using the old address merely because its approval list now looks empty. For an ordinary approval cleanup, retain the transaction reference and the checked network so that a later review can distinguish a confirmed revocation from a disconnected website.
Frequently asked questions
Does disconnecting a dapp cancel its spending allowance?
No. A website connection and a token allowance are different. Check and revoke the on-chain permission separately.
Does revocation cost a fee?
Yes, the revocation transaction normally requires a network fee. Check confirmation before treating the permission as removed.
Will revoking an approval return stolen tokens?
No. It removes the relevant permission going forward; it does not reverse an already completed transfer.
Is revocation enough if my recovery phrase leaked?
No. Anyone with the phrase can control that wallet and grant permissions again. Use a new wallet with a fresh recovery phrase.
Evidence & sources
Source record: · Checked:
- Source reported
Ethereum.org distinguishes disconnecting a website from revoking token access and explains network-specific review.
Supporting excerpt: How to revoke smart contract access to your crypto funds
Make sure you use the same network in your wallet and website.
How to revoke smart contract access to your crypto funds ↗ - Source reported
ENS describes collection-wide permissions and warns that revocation cannot reverse completed transfers or repair an exposed recovery phrase.
Supporting excerpt: Revoke token approvals
Revoking doesn't undo transfers that already happened.
Revoke token approvals ↗
