Token Approvals and Revoking — Security Hygiene
Anna hasn't used OldSwap for a year, but her old unlimited approval still lets it move her USDT. An approval is a key you give a protocol: Connect is not yet a permission, exact versus unlimited, why a forgotten approval is an open door when a protocol is hacked, how to revoke it (revoke.cash for Ethereum, solscan.io for Solana), and the extra EIP-7702 delegation.
When you confirm an approve transaction on a DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → protocol, you grant permission (an approval) for a smart contract to use your tokens. This is a foundation of DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → — nothing would work without it. Here you'll learn to see that permission, manage it, and revoke it at any time. Checking approvals regularly is like washing your hands: simple, and it becomes second nature.
What Is a Token Approval?
Approval — your permission for a protocol to use your tokens. Revoke — canceling that permission.
When you want to use a DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → protocol (e.g. OrcaOrcaA Solana DEX with concentrated liquidity (Whirlpool). The basis of our LP strategy on the Solana network.Read the lesson →, UniswapUniswapAn Ethereum concentrated-liquidity protocol (V3/V4). Its Solana counterpart is Orca.Read the lesson →, AaveAaveEthereum lending protocol (v3). In our strategy: ETH collateral to a USDC loan.Read the lesson →), it asks for permission:
"Let me use your 100 USDCUSDCA USD stablecoin issued by Circle. Regulated, audited monthly. Our primary stablecoin and loan asset in the Kamino/Aave strategies.Read the lesson → for this transaction"
You confirm — and the protocol can use your tokens. This is normal and necessary for DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → to work.
Simply connecting your wallet doesn't grant any permission by itself — an approval only exists once you sign an approve transaction. For the same reason, disconnecting from a site does not cancel an approval: that requires a separate revoke.
Important to know: some protocols ask for an unlimited approval — permission to use your ENTIRE balance of that token, ALWAYS, with no time limit. (An approval is scoped to a single token — e.g. an unlimited USDCUSDCA USD stablecoin issued by Circle. Regulated, audited monthly. Our primary stablecoin and loan asset in the Kamino/Aave strategies.Read the lesson → approval doesn't reach your ETH.) This is usually just a matter of convenience — and you can choose otherwise.
Limited vs. Unlimited Approval
| Type | What it means | How much the protocol can reach |
|---|---|---|
| Limited (e.g. 100 USDCUSDCA USD stablecoin issued by Circle. Regulated, audited monthly. Our primary stablecoin and loan asset in the Kamino/Aave strategies.Read the lesson →) | The protocol can use only 100 USDCUSDCA USD stablecoin issued by Circle. Regulated, audited monthly. Our primary stablecoin and loan asset in the Kamino/Aave strategies.Read the lesson → | Only 100 USDCUSDCA USD stablecoin issued by Circle. Regulated, audited monthly. Our primary stablecoin and loan asset in the Kamino/Aave strategies.Read the lesson → — it can't reach more |
| Unlimited (max uint256) | The protocol can use your ENTIRE balance of that token AT ANY TIME | Your entire balance of that token stays accessible |
For convenience — so you don't have to approve again every single time. It's a simple trade-off: you see the "convenience" on offer, then ask yourself "how much access am I giving up for it?" Best practice is to give only what's needed, and decide for yourself when.
How to Check Your Approvals
Ethereum / Arbitrum ETH
Go to revoke.cash
Open revoke.cash in your browser — it is a free tool for checking approvals.
Connect with MetaMask
"Connect Wallet" → MetaMask → confirm the connection.
Choose the network
At the top, choose "Ethereum" or "Arbitrum" — depending on where you use DeFi.
Review the approval list
You will see every protocol you have granted permission to. Each row shows: the token, the protocol, the amount allowed.
Revoke what you do not need
Each approval has a "Revoke" button. Click it to cancel the permission. You will need to pay a small gas fee.
Solana SOL
Go to Solscan
Open solscan.io and search for your wallet address.
Find the "Token Accounts" section
Here you will see all your tokens and their delegates (Solana's equivalent of an approval).
Check the delegates
If a token has a "delegate," it means you have granted someone permission to use it.
Remove the delegate
Connect to revoke.cash with your Solana wallet (Jupiter Wallet, or any other Solana wallet such as Phantom) — the tool supports Solana too — and click "Revoke" next to the delegate. Cost: less than a cent.
EIP-7702 delegations ETH
Since the Pectra upgrade (May 2025), a single signature can grant a contract the right to act on behalf of your EthereumEthereumA blockchain with smart contracts. We use Aave (lending) and Uniswap (LP) on it.Read the lesson → wallet — this is called an EIP-7702 delegation. It is not an approval: a delegation covers not one token but the whole wallet, and it reaches even the funds that arrive later.
The practical detail that matters most: revoke.cash cannot revoke these delegations — it only shows them. So the audit now has two steps:
- Approvals → revoke.cash → the "RevokeRevokeCancelling a previously granted approval (e.g. via revoke.cash) so the protocol can no longer touch your tokens.Read the lesson →" button
- 7702 delegations → the "Delegations" tab on revoke.cash tells you whether a delegation is active; you switch it off inside the wallet only: MetaMaskMetaMaskAn Ethereum/EVM wallet. Used with Aave, Uniswap and Arbitrum.Read the lesson → → Account Details → turn off "Enable Smart ContractSmart ContractA program running on a blockchain. Executes operations automatically according to its programmed rules.Read the lesson → Account". On each chain separately.
Why this matters: a 2026 USENIX Security study counted 2,322,548 out of 3,664,166 EIP-7702 authorizations (63%) as attacker-related, with roughly $2.36M in confirmed losses. While a delegation is active, "I revoked every approval" does not mean the wallet is clean.
What to Revoke, What to Keep
| Situation | Action | Why |
|---|---|---|
| A protocol you no longer use | Revoke | No reason to hold the risk |
| An unknown protocol | Revoke IMMEDIATELY | Could be phishing |
| Actively used (OrcaOrcaA Solana DEX with concentrated liquidity (Whirlpool). The basis of our LP strategy on the Solana network.Read the lesson →, AaveAaveEthereum lending protocol (v3). In our strategy: ETH collateral to a USDC loan.Read the lesson →) | Keep (or reduce) | You would have to re-approve |
| Unlimited approval on an old protocol | Revoke | Switch to limited when you need it again |
When Should You Check Approvals?
It's recommended to check your approvals in these situations:
| When | Why |
|---|---|
| After every new protocol | Check exactly what you approved |
| Every week | Regular hygiene |
| After hack news | If a protocol got hacked — revoke immediately |
| Before a larger transfer | Reduce risk before moving capital |
How Much Does a Revoke Cost?
| Network | Revoke cost | Note |
|---|---|---|
| SolanaSolanaA fast blockchain (under 1s, gas under $0.01). Home to the Kamino, Orca and Meteora ecosystem.Read the lesson → SOL | < $0.01 | Practically free |
| ArbitrumArbitrumAn Ethereum Layer 2 network. Cheaper and faster transactions than Ethereum mainnet.Read the lesson → ETH | < $0.01–0.05 | Practically free |
| EthereumEthereumA blockchain with smart contracts. We use Aave (lending) and Uniswap (LP) on it.Read the lesson → mainnet ETH | ~$0.03–0.30 | Cents — can get temporarily pricier during congestion |
Yes — revoking now costs cents everywhere, so there's no reason to put it off: the moment you spot an approval you don't need, revoke it. Fees move with network load (etherscan.io/gastracker shows the current price), but even during congestion, the cost of revoking is trivial next to the access it hands back to you.
- An old unlimited approval sits forgotten → revoke.cash / Solscan show you every approval each week — you revoke the ones you no longer use
- An unfamiliar protocol has an approval → revoke it immediately with the RevokeRevokeCancelling a previously granted approval (e.g. via revoke.cash) so the protocol can no longer touch your tokens.Read the lesson → button, before it reaches anything
- A new protocol asked for too much → you choose a limited approval instead of unlimited — you set the ceiling
- A protocol shows up in hack news → you go straight to revoke.cash and revoke that protocol's approval
Every situation has a concrete solution. You're not afraid of approvals — you learn to manage them with one click.
Approval Security Checklist
| # | Rule | Status |
|---|---|---|
| 1 | Check approvals every week | ☐ |
| 2 | RevokeRevokeCancelling a previously granted approval (e.g. via revoke.cash) so the protocol can no longer touch your tokens.Read the lesson → old protocols' approvals | ☐ |
| 3 | Use limited approval when possible | ☐ |
| 4 | After a new protocol — check what you approved | ☐ |
| 5 | After hack news — check right away | ☐ |
| 6 | Use a separate wallet for experiments | ☐ |
Practical Example: Managing Approvals in Our Strategy
Solana Strategy (Kamino + Orca) SOL
Ethereum Strategy (Aave + Uniswap) ETH
| Protocol | Tokens | Approval type | Action |
|---|---|---|---|
| AaveAaveEthereum lending protocol (v3). In our strategy: ETH collateral to a USDC loan.Read the lesson → | ETH, USDCUSDCA USD stablecoin issued by Circle. Regulated, audited monthly. Our primary stablecoin and loan asset in the Kamino/Aave strategies.Read the lesson → | Unlimited (default) | Consider reducing |
| UniswapUniswapAn Ethereum concentrated-liquidity protocol (V3/V4). Its Solana counterpart is Orca.Read the lesson → V3 (Permit2) | USDCUSDCA USD stablecoin issued by Circle. Regulated, audited monthly. Our primary stablecoin and loan asset in the Kamino/Aave strategies.Read the lesson →, ETH | Permit2 system | Check the Permit2 approval |
| Old/unused | Any | Any | Revoke |
Summary
- Approval = permission for a protocol to use your tokens
- Unlimited approval = permission worth managing — you decide who gets it and how much
- revoke.cash (ETH, now also SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson →) and Solscan (SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson →) — the tools for checking
- An EIP-7702 delegation is only displayed by revoke.cash — you switch it off inside the wallet, on each chain separately
- Check every week and after every new protocol
- Revoke anything you no longer use
- The cost is small — control stays entirely yours
An approval audit is like washing your hands: simple, quick, and it protects you from big trouble. Takes about 10 minutes.
A revoke transaction costs a small gas fee — that's normal. But if any tool asks for your seed phrase, it is NOT a revoke tool — it's a scam.
This is learning, not investing — use only small amounts you treat as tuition.
You just took control of your wallet's permissions — you can see every approval and know how to revoke it. This is a skill most crypto users never master.