Token Approve is the standard mechanism ERC20 tokens use to interact with smart contracts, but it is also the single biggest DeFi attack vector of 2024-2026. This article walks through how Approve works and how to revoke it. The bottom line up front: every DeFi interaction can leave behind an Approve residue, leaving old approvals unrevoked lets risk quietly accumulate, and auditing with Revoke.cash every month and revoking unnecessary approvals should be a standard habit for any DeFi user. For your everyday primary/backup account setup, register a main account through the Binance Official Site, install the Official Binance App on Android, and iPhone users switching to an overseas Apple ID should check the iOS install guide.

I. How the Approve Mechanism Works

The two-sided mechanism of ERC20 tokens:

The ERC20 token standard defines two ways to move tokens:

  1. transfer: the user sends tokens themselves (you send USDC to someone else)
  2. transferFrom: a contract moves tokens on your behalf (a smart contract pulls USDC out of your account)

transferFrom requires an Approve first:

Step 1: the user calls approve(spender, amount) on the USDC contract
        - spender = the contract address
        - amount = the approved amount

Step 2: the contract calls transferFrom(user, recipient, amount)
        - this only succeeds within the approved amount

For example, using Uniswap:

Step 1: the user Approves the Uniswap Router to pull USDC (a one-time Approve for 1000 USDC)
Step 2: the user starts a USDC → ETH swap on Uniswap
Step 3: the Uniswap Router calls USDC.transferFrom to pull the USDC
Step 4: the Uniswap Router sends the user the corresponding amount of ETH

Approve is the underlying mechanism behind every DeFi interaction with an ERC20 token.

Q: Do you have to re-Approve for every interaction?

No. An Approve is persistent:

This is the root of accumulated Approve risk: leave approvals unrevoked long enough and a huge pile of old approvals builds up.

II. The Two Types of Approve

Limited Approval:

Unlimited Approval (MaxUint256):

Why unlimited approvals exist:

The risk of unlimited approvals:

A real case:

In December 2024, a user had granted Unlimited USDC approval to Uniswap back in 2022. In December 2024, that same wallet received a deposit of 50,000 USDC — two hours later a malicious contract (a fake router disguised as Uniswap V3) called transferFrom and drained the entire balance. A post-mortem found the phishing contract had exploited the user's old, forgotten Approve.

Q: Should you choose limited or unlimited approvals?

The safety-first camp (recommended): manually Approve the exact amount needed for each interaction

The convenience camp: default to unlimited approvals

Common strategy:

III. Common Forms of Approve Attacks

Form 1: Phishing-site Approve attacks

A phishing site mimics a real interface, and once you connect your wallet it has you sign an Approve transaction:

Form 2: Permit signature attacks

EIP-2612 introduced the permit function, which lets approvals happen entirely through a signature (no on-chain transaction):

Why Permit attacks are dangerous:

Form 3: A protocol you approved years ago gets hacked

An old Approve on a compromised protocol:

Form 4: Malicious token drainers

A phishing site bundles multiple approvals into a single signature:

Q: Is Permit more dangerous than Approve?

Yes, Permit is significantly more dangerous:

Dimension Approve Permit
On-chain Yes No (signature only)
Costs gas Yes No
Wallet readability Fairly clear Not intuitive
How to revoke An on-chain Revoke transaction Cannot be revoked (requires changing the contract nonce)
User vigilance High Low

Always carefully check the token, amount, and recipient of any Permit signature.

IV. A Deep Dive Into Revoking Approvals

The leading revoke tools:

Revoke.cash (the most widely used, recommended):

Etherscan Token Approval:

Solscan Approval (Solana):

Steps to use Revoke.cash:

1. Go to revoke.cash
2. Click "Connect Wallet" (MetaMask / Rabby)
3. Your approvals load automatically, grouped by token / protocol
4. Review the list:
   - Token name (USDC, USDT, WETH, etc.)
   - Approved spender (contract address + known protocol name)
   - Approved amount (a specific figure, or Unlimited)
   - Risk rating (red = high risk, green = a known protocol)
5. Click "Revoke" on any approval that looks suspicious
6. Sign in the MetaMask pop-up and pay gas
7. Wait for it to confirm on-chain (5-30 seconds)

The gas cost of a Revoke:

Chain Cost per revoke
Ethereum mainnet $5-30
Polygon <$0.01
Arbitrum / Optimism / Base $0.1-1
BNB Chain $0.05-0.30
Solana <$0.01

Q: Does revoking an Approve cost gas?

Yes. A Revoke is an on-chain transaction, so it costs gas. But:

Optimization tips:

V. A Standard Process for Auditing Approvals Regularly

Audit frequency:

User type Suggested frequency
Active DeFi user (5+ interactions per week) Monthly
Moderate DeFi user (5-20 interactions per month) Every 3 months
Low-frequency DeFi user (<5 interactions per month) Every 6 months

Audit steps:

Step 1: Connect your wallet to Revoke.cash

Step 2: Sort your approvals by risk

Rank by risk level:

Step 3: Revoke anything unnecessary

Guidelines for what to revoke:

Step 4: Keep a record of the approvals you keep

Record for each approval you retain:

Step 5: Verify after every audit

Q: Before revoking, how do you know whether a protocol is "known" and safe?

Ways to check:

  1. Protocol name: the label Revoke.cash shows (e.g. "Uniswap V3 Router")
  2. Contract address: search Etherscan to see whether the contract is verified and belongs to a mainstream protocol
  3. The protocol's DefiLlama page: check its TVL and how long it's been operating
  4. Official documentation: the contract address the project team has published

Any unrecognizable contract with an Unlimited approval is high risk — revoke it immediately.

VI. Managing Approvals Across Different Chains

Ethereum mainnet and EVM-compatible chains:

Solana:

Bitcoin:

Move-based chains (Sui / Aptos):

Q: Is there Approve-style risk on Solana?

Yes. Solana's "signature-based authorization" carries similar risk:

Common Solana phishing lures:

The defensive principles are the same as on Ethereum.

VII. Best Practices for Managing Approvals

1. Approve a specific amount every time

Adjust the Approve prompt in MetaMask:

2. Separate your main wallet from your active wallet

3. Revoke stale protocol approvals

Audit every month:

4. Watch out for "bundled signatures"

5. Use a signature-decoding tool

Q: Can you revoke every Approve at once?

There's no "revoke everything" button:

Some tools offer a batch "queue":

VIII. A Special Case: NFT Approvals

NFTs have their own Approve mechanism too:

The risk with NFT approvals:

A real case:

In May 2024, a user signed setApprovalForAll on a fake OpenSea site, granting a malicious contract control over their BAYC NFT. The BAYC was immediately transferred to the attacker's address, a loss of roughly $120,000.

Revoking an NFT approval:

Q: Do you have to approve to sell an NFT on OpenSea / Blur?

Yes. The major NFT marketplaces all require authorization before you can list:

The safer habit:

IX. Frequently Asked Questions

Q: What's the minimum gas cost for a single Approve?

Standard Approve gas cost on Ethereum mainnet:

On L2s / Polygon / BSC an Approve usually costs under $1.

Q: Can a revoked Approve be reactivated?

No, not directly. Once revoked it's as if you'd never approved anything — you have to Approve again from scratch:

Q: Do all ERC20 tokens require Approve?

Yes. Every standard ERC20 token follows the Approve mechanism:

Exceptions:

Q: Does an Approve lock up your tokens?

No. Approve does not lock tokens:

An Approve is similar to a "credit card limit": you're giving a merchant a spending limit, but the money is still sitting in your own bank account.

Q: How do you revoke a Permit signature?

A Permit signature can't be directly "revoked," but there are indirect workarounds:

The real key to Permit safety is prevention: read carefully before signing every Permit request.

Q: Is USDT approval risk the same as USDC?

Broadly similar, but with some differences in the details:

Q: Can you look up a wallet's full approval history?

Yes:

Q: Does revoking an Approve take effect immediately?

Yes. Once the Revoke confirms on-chain it takes effect right away:

Q: Can you revoke approvals across multiple wallets at once?

No. Every wallet is independent:

For users with multiple wallets: audit each wallet separately every month.

Data Sources

Risk disclaimer: This article is an independent third-party summary and does not constitute investment advice. Approve remains the leading attack vector in DeFi, and regular auditing and revoking are basic security practices. All data is as of April 2026.