Token Approvals & Revoke Permissions — How to Clean Approvals

Try Tangem secure wallet →

Token Approvals & Revoke Permissions — How to Clean Approvals (Mobile Wallet Guide)

Table of contents


Who this guide is for

This guide is written for people who use a mobile software wallet to trade, stake, or use DeFi daily. If you connect to dApps with an in-app browser or WalletConnect (and you probably do), this affects you. I write from hands-on testing and daily checks of approval lists. What I've found helps reduce risk without adding friction.

And yes, you should audit approvals regularly.

What is a token approval / token allowance?

A token approval (also called token allowance) is an on-chain permission you give to a smart contract so it can move tokens from your address. On EVM-compatible chains this is typically the ERC-20 approve(spender, amount) pattern (BEP-20 is similar). The wallet asks you to sign a transaction that sets a spender's allowance.

Why does this matter? Because an unlimited token allowance (commonly used to avoid future prompts) gives that contract permission to drain the approved token from your balance until allowance is set back to zero. What happens if a contract is malicious, or compromised, or you connected to the wrong website? You may lose funds.

(Other chains such as Solana use different token-program mechanics for delegation — approvals exist but tooling differs.)

How approvals get created (real steps I tested)

I tested a common swap flow on a mobile wallet using the in-app browser and again via WalletConnect. The sequence looked like this:

  1. Open dApp > connect wallet (the dApp requests a provider connection).
  2. Choose token pair and tap "Approve" for a token not previously allowed.
  3. The wallet shows an approval transaction preview (contract address, gas-fee estimate) and asks for signature.
  4. After signing, the allowance is stored on-chain; the dApp then calls transferFrom when the swap executes.

In my test on an EVM chain, the approval transaction confirmed in under a minute when I used a normal priority fee. It consumed a similar amount of gas as a simple ERC-20 transfer (ranges vary by network). The approval showed immediately in the wallet’s approvals list.

But I once clicked the approve button too fast and allowed an unlimited allowance to a contract I didn’t intend to trust. I revoked and moved funds out immediately. Lesson learned.

How to check approvals in your mobile wallet and elsewhere

Most modern mobile wallets include an approvals or "connected apps" screen. If your app doesn't show it, use a third-party approval manager or a block explorer.

How I check (step-by-step):

If you want a second opinion, use a public approval-auditing site or view allowances on a block explorer. I cross-check contract addresses on the explorer before I revoke anything.

Related reading: token-management | dapp-browser | walletconnect

Step-by-step: revoke approvals from the mobile app

How to revoke approvals safely. Follow this step-by-step (tested in-app):

  1. Fund your wallet with a small amount of the native token (ETH, BNB, etc.) to cover gas fees.
  2. Open Settings > Approvals (or "Manage approvals").
  3. Choose the chain where the token lives.
  4. Find the dApp/contract you want to revoke. Confirm the contract address (copy & check on a block explorer if unsure).
  5. Tap "Revoke" (or set allowance to 0). The wallet will create an on-chain transaction requiring your signature.
  6. Confirm the gas fee and sign. Wait for confirmation — usually one or two blocks.
  7. Refresh the approvals list to confirm allowance is zero.

And check your token balances after; if you revoked while a pending swap was in-flight, it may fail. But that's better than leaving a dangerous unlimited allowance in place.

Alternative: revoke with approval-manager sites or block explorers

If your app has no approvals screen, use a reputable approval manager or a block explorer that can submit an allowance-change transaction. Process (typical):

Security notes: double-check domain spelling, look for TLS (https), and verify contract addresses on a block explorer before signing. Phishing sites can mimic approval managers.

Related: revoke-approvals | walletconnect

Gas fees, timing, and smart-contract wallets

A revoke is an on-chain transaction; it requires native token gas. On Ethereum mainnet, gas can be costly during congestion. In my tests a revoke typically consumes the same order of gas as a simple token transfer (tens of thousands of gas units). On cheaper EVM-compatible chains or many L2s it’s far less.

Tips from practice:

But don’t assume gasless means no risk — you still need to confirm the transaction and the contract address.

Common mistakes, recovery steps, and lessons I learned

Common errors:

If you suspect a malicious approval:

  1. Revoke the allowance immediately.
  2. Move remaining funds to a new address (generate new seed phrase and restore there) if you think keys were exposed.
  3. Use hardware wallets for larger balances.

What I've found: revoking quickly and moving funds reduces loss risk but does not guarantee recovery if tokens have already been drained.

For seed backups and recovery see: backup-recovery-seed-phrase | restore-import-wallet

Quick comparison: revocation methods

Method Ease of use On-chain cost Security notes Best for
In-app Approvals UI High Yes (one tx) Usually safest when provided by the wallet Everyday quick fixes
Approval-manager websites (WalletConnect) Medium Yes (one tx) Verify domain and contracts; follow best practices If no in-app UI
Manual revoke via block explorer Low (advanced) Yes (one tx) Full control, but manual steps Advanced users who verify everything

FAQ

Q: How do I revoke token approvals?
A: Use your wallet’s Approvals/Connected Sites screen or connect to an approval-manager via WalletConnect and set the allowance to 0 (then sign the revoke transaction). See the step-by-step above.

Q: Is it safe to keep crypto in a hot wallet?
A: Hot wallets are convenient but expose private keys to online risk. For everyday trading they work fine if you follow best practices (seed phrase offline, regular approval audits, small daily balances). For large holdings consider a hardware wallet.

Q: What happens if I lose my phone?
A: If you have your seed phrase you can restore on another device. If not, funds are likely lost. See restore-import-wallet and backup-recovery-seed-phrase for recovery steps.

Q: How often should I audit approvals?
A: Monthly or before/after connecting to a new dApp. I check mine after any unfamiliar approval request.

Conclusion & next steps

Revoke unneeded token approvals often and keep a small native-token balance to pay for revokes when needed. I believe a short monthly audit will dramatically reduce risk for most active DeFi users. If your mobile wallet lacks an approvals UI, connect via WalletConnect to a reputable approval manager or use a block explorer.

Start here: check your current approvals and then follow the step-by-step revoke flow above. For more on token handling and portfolio hygiene see token-management and our deeper guide on revoke-approvals.

But don’t blindly approve anything — double-check addresses, and move large balances to cold storage when you can.

Try Tangem secure wallet →