How to revoke token approvals (and why you should)
The Editor·9 min read·Updated 31 Aug 2026
How to revoke token approvals across EVM chains and Solana, why unlimited allowances are the real risk, and why memecoin traders accumulate dozens per session.
An approval is a standing permission for a contract to move your tokens, and it does not expire. Revoke by opening an approval manager such as Revoke.cash, connecting the wallet on the correct chain, and submitting a revocation transaction for each allowance you no longer need. Each revocation costs gas. Start with unlimited allowances on contracts you cannot identify.
What you are actually granting
On EVM chains, an ERC-20 token contract keeps a mapping of allowances: for each holder, how much of their balance a given spender contract is permitted to move. When a DEX or launchpad front-end asks you to "approve" a token before your first trade, it is writing into that mapping. The approval and the swap are two separate transactions because they do two separate things.
Two properties make this dangerous in a way most people never internalise. Allowances persist indefinitely — there is no expiry, no renewal, no prompt to review. And the default in most front-ends is an unlimited allowance, set to the maximum value the type can hold, because it saves the user a second approval on every subsequent trade. The convenience is real. The cost is that a contract you interacted with once retains permission to move your entire balance of that token, forever, from that wallet.
The risk is not primarily that the contract was malicious when you approved it. It is that a contract can become malicious later: a proxy implementation can be swapped for different code, an owner key can be stolen, a team can turn. An approval granted in July is exercisable in December against whatever balance is in the wallet at that time — including tokens you acquired long after you forgot the site existed.
Why memecoin traders accumulate more of these than anyone else
This is where generic approval advice stops being adequate.
A normal DeFi user approves a handful of well-known routers and stops. A memecoin trader approves everything. A single active session might touch three or four launchpad front-ends, two aggregators, a router per venue and a bridge — and on a chain in its first months, most of those contracts were deployed weeks ago by teams with no track record. Robinhood Chain went live on 1 July 2026 and had roughly fifteen launchpads competing within nine weeks; on 17 July 2026 it recorded 42,709 tokens created in 24 hours. The pace that makes the chain interesting is the same pace that produces a wallet with dozens of live allowances to contracts nobody has audited.
Two aggravating patterns follow. Bridging and cross-chain trading mean the same wallet address carries independent allowance sets on Solana, Base, BNB, Ethereum and Robinhood Chain, and revoking on one does nothing on the others. And approving a token in order to sell it is the step where honeypot mechanics bite — tokens engineered so that sells fail still take the approval happily.
Approvals are also the payload in most drainer sites. A cloned front-end does not ask you to send funds; it asks you to sign something framed as a claim or a vote, and what you actually grant is an allowance. Cloned DEX and bridge front-ends covers how those are distributed, and it is the reason a periodic revocation sweep matters even when you are confident nothing has gone wrong.
How to revoke, step by step
1. List the wallets and chains you actually use. Every address you have traded from, and every chain you have traded on with it. Allowances are per chain, per token, per spender. Missing a chain means missing a whole allowance set.
2. Check before you connect. Revoke.cash — the standard tool for this — lets you paste an address and view its approvals in read-only mode without connecting a wallet. Do that first. Some wallets, Rabby among them, include an approval manager natively, and most block explorers expose a token-approval view for an address. Reaching any of these through a bookmark rather than a search result matters here as much as anywhere.
3. Triage rather than revoking everything. Sort by what can actually hurt you: unlimited allowances first, then spenders you cannot identify, then allowances on tokens where you currently hold a meaningful balance. An allowance against a token balance of zero is harmless today, but it is not harmless if you buy that token again later.
4. Submit the revocations. Setting an allowance to zero is an on-chain transaction and costs gas, once per token per spender per chain. This is the point where people give up, so do the expensive chains selectively and the cheap ones thoroughly. On a fast, low-fee L2 the whole sweep is inexpensive; on Ethereum L1 it is not, and prioritising is rational.
5. Handle Permit2 separately. Uniswap's Permit2 contract is an intermediary: you approve Permit2 on the token, then Permit2 grants time-bounded permissions to individual spenders. Revoking the token-to-Permit2 allowance is not the same as revoking the Permit2-to-spender permissions, and approval managers list them as distinct entries. Check both. This matters on any chain where Uniswap dominates — on Robinhood Chain it handled roughly 85% of DEX volume on 31 August 2026 ($1.109bn of $1.302bn in 24 hours, DefiLlama).
6. Do the same on Solana, where the model differs. Solana has no ERC-20 allowance mapping. The analogous mechanism is a delegate on a token account: an Approve instruction authorises a delegate to move up to a set amount, and a Revoke instruction clears it. Delegates are visible on the token account in Solscan and in the wallet-level revoke tools built into major Solana wallets. The practical difference is that most Solana memecoin trading signs a transaction that moves tokens directly rather than granting a standing permission, so persistent allowances are less central — and the corresponding risk shifts onto what you sign in the moment, including transactions carrying instructions you did not read. What changes between Solana and EVM when you trade memecoins covers that split in full.
7. Reduce future accumulation. Where a front-end offers a capped approval — an amount matching the trade rather than the maximum — take it, accepting the extra transaction. Use a dedicated wallet for launch-day activity, funded with only what you intend to risk, so that an allowance granted at 2am reaches nothing you care about. And set a review cadence rather than reacting to news.
What revoking does not do
It does not reverse anything. If a drainer has already moved your tokens, revoking afterwards is closing a door on an empty room.
It does not protect a compromised wallet. If your seed phrase or private key has leaked, the attacker does not need an allowance — they can sign as you. Revoking in that situation is wasted gas and wasted time. Move everything to a wallet generated on a clean device, and treat the old address as permanently unsafe. If that is the situation you are in, the first hour after a wallet is drained sets out what to preserve and where to report it.
It does not stop a token contract itself from harming you. Blacklists, mutable transfer taxes, owner-callable mints and pause functions live in the token's own code and are unaffected by your allowance settings. Reading a token contract line by line is the check for those.
And it does not prevent the next approval. Nothing about a revocation sweep changes what you will grant tomorrow to the next launchpad you try.
What this doesn't tell you
There is no published figure for how much of annual crypto theft runs through stale approvals specifically, so this article does not offer one. The mechanism is well documented; the share is not, and inventing a number would be worse than leaving the gap visible.
A clean approval list is also a weak signal about safety generally. It tells you no contract currently holds standing permission over your balances. It tells you nothing about whether the tokens in the wallet are worth anything, whether the pools you trade in are real, or whether the next site you visit is the one it claims to be. Monitoring balances continuously — The Crypto App handles alerts and portfolio tracking across chains — catches an exploited approval faster than a monthly review does, though it catches it after the fact rather than before.
Meme Central surfaces a per-chain safety report on each token page in the live launch feed, covering contract-level risks rather than your wallet's permissions. The two are separate problems and both need checking.
Frequently asked questions
Does revoking a token approval cost gas?
Yes. Setting an allowance to zero is a state change on the token contract, so it is a normal transaction with a normal fee, charged once per token per spender per chain. There is no batch discount on most chains. Read a live quote before a large sweep rather than assuming, and prioritise unlimited allowances if you are revoking selectively.
Are unlimited approvals always bad?
They are a convenience with an open-ended downside. An unlimited allowance to a long-lived, widely used router is a different proposition from one granted to a launchpad contract deployed last week. The realistic policy is to accept a small number of unlimited approvals to contracts you would defend in writing, cap or revoke everything else, and keep launch-day activity in a separate wallet.
Do token approvals expire on their own?
No. An ERC-20 allowance persists until it is spent down or explicitly changed, with no expiry and no reminder. Permit2 permissions are the exception — they carry an expiry — but the underlying token-to-Permit2 allowance does not. A permission granted a year ago is exercisable today against whatever balance the wallet holds now.
How do approvals work on Solana?
Through delegates rather than allowances. An Approve instruction lets a delegate move up to a set amount from a specific token account, and Revoke clears it. Solscan shows any delegate on a token account, and major Solana wallets include a revoke view. Most memecoin trading signs direct transfers instead, so the greater Solana risk is what a single transaction actually contains.
I already got drained. Does revoking help?
Not for what has gone. Revoke only if you are certain the loss came from an approval rather than a leaked key — if the key is compromised, revocations are pointless and you need a new wallet immediately. Either way, preserve the transaction hashes before you do anything else, because they are the only evidence you will have.
The other side of the same permission problem
Approvals are a buyer deciding how much control to hand a contract they cannot audit. A launch is the mirror image — buyers deciding how much to trust a creator they cannot audit. Team Finance liquidity locking — built by TrustSwap, which also builds Meme Central — locks LP tokens for a fixed term on Ethereum, Robinhood Chain, Polygon, Base and BNB, and the lock shows as a verified badge on the token's page in the Meme Central feed. It removes one question from a buyer's list. It does not make your contract safe to approve, and it does not stop you selling your own allocation.
Nothing here is financial, legal or tax advice. Memecoins are extremely high-risk: most lose most of their value, and the majority of tokens launched never reach a decentralised exchange at all. Never spend money you cannot afford to lose entirely. Meme Central does not recommend any specific token. Data described as Meme Central's own reflects tokens indexed by Meme Central and is not whole-market data.
