Quick answer
An approval is a spending permit, not a one-time transfer.
On Ethereum, many token apps cannot move ERC-20 tokens out of your account unless you first authorize a spender. That authorization can remain valid long after you leave the site. Review the spender and the amount before you sign, and revoke permissions you no longer need.
How ERC-20 approvals actually work
The ERC-20 token standard defines approve, allowance, and transferFrom. A direct transfer sends tokens yourself. An approval is different: it lets another contract withdraw tokens on your behalf, which is how most swaps, deposits, and bridges complete a later step without asking you to send the token first.
The specification says a spender may withdraw multiple times, up to the approved amount. Calling approve again overwrites the current allowance for that spender. Setting the allowance to zero is the usual way to revoke access. The ERC-20 note also warns that changing a non-zero allowance straight to another non-zero value can create a race if the spender uses the old value first; wallet interfaces are expected to go through zero when they change an existing allowance.
Token approval
An on-chain permission that lets one spender move a specific token from your account, up to a remaining allowance.
It does not give that spender your ETH unless you also approved WETH or another token, and it does not reveal your recovery phrase.
Allowance
The remaining amount that spender may still withdraw. Each successful transferFrom reduces it until you overwrite the value.
A new approve call replaces the previous allowance for that same owner, token, and spender pair.
Wallet connection
A site can see your public address and propose transactions after you connect.
Disconnecting the site does not cancel an allowance that already exists on-chain.
Why apps ask for unlimited access
Ethereum.org and MetaMask both describe unlimited allowances as a convenience: you approve once, pay the network fee once, and later trades do not need another approval transaction. That convenience is also the risk. If the spender contract is malicious, compromised, or later upgraded in a way you did not intend, it can move the entire remaining approved balance.
Ethereum.org is explicit that withdrawing tokens from a platform does not cancel an unlimited approval. The spender can still move tokens that remain in your wallet. Official security guidance is to approve only what the current transaction needs when your wallet lets you set a limit, and to revoke access you no longer use.
A Layer 2 bridge can request an approval and a transfer in the same session. Read both prompts. A familiar app name in the browser chrome is not proof that the spender address on the signing screen is the contract you intended.
A six-point review and revoke checklist
- 1
Read the spender and the amount before you sign
A token approval is not the same as sending ETH. Confirm the token, the spender contract, and whether the amount is limited or effectively unlimited. If those details are missing or unreadable, reject the prompt.
- 2
Prefer a limited allowance when the wallet offers one
Ethereum.org recommends setting a spend limit to the amount needed for the transaction. MetaMask documents a way to customize token permissions. A limited allowance can still be drained up to that limit, so it is a reduction in blast radius, not a guarantee.
- 3
Open a checker you typed or bookmarked
Ethereum.org and MetaMask both list the Etherscan token approval checker for Ethereum. Type or bookmark etherscan.io yourself. Do not follow an approval-checker link from a DM, comment, airdrop page, or search ad. Fake checkers are a common drain path.
- 4
Match the network you actually used
An Ethereum mainnet checker will not show allowances created on another chain. If you approved a token on a rollup or a sidechain, use that network’s official explorer after you have verified the hostname.
- 5
Revoke unused or surprising spenders
Revoking writes a new on-chain approval, usually to zero, and costs a network fee. Ethereum.org says you can revoke permissions you do not recognize; you will simply need a fresh approval the next time you use that app.
- 6
Confirm the result after the fee lands
Wait for the revocation to confirm, then refresh the checker. If the spender is still listed with a non-zero allowance, do not assume it worked. Check the transaction status and the network before trying again.
Common mix-up
Disconnecting a site does not revoke the allowance
MetaMask and Ethereum.org both separate these actions. Disconnecting stops the site from seeing your address in that wallet session. Revoking is an on-chain transaction that removes the spender’s remaining allowance. If you only hit Disconnect, a previously approved contract can still move tokens.
Official guides also say these permissions do not expire. An unused unlimited approval from last year can still be used this year. Reviewing allowances is a recurring check, not a one-time setup.
If a spender already moved tokens
Save the transaction hash, the token contract, and the spender address. Revoke any remaining allowance so further withdrawals stop. Confirmed cryptocurrency transfers are typically not reversible; recovery depends on the recipient returning the funds. The U.S. Federal Trade Commission warns that nobody may be able to step in and restore the balance. Treat anyone promising guaranteed recovery for an upfront fee as another risk.
A revocation still needs a network fee. Check current conditions on the live gas tracker and read how Ethereum gas fees work before you sign. A lower fee does not make an unread spender prompt acceptable.
Continue safely
Token approval FAQ
What is a token approval on Ethereum?
An ERC-20 approval lets a specific spender contract move tokens from your account up to an allowance you set. The spender can call transferFrom multiple times until that remaining allowance is used or overwritten.
Is an unlimited token approval the same as sharing my seed phrase?
No. An approval does not reveal your private key or recovery phrase. It only authorizes that spender to move the approved token, up to the remaining allowance, until you change or revoke it.
If I disconnect my wallet from a site, are the approvals gone?
No. Disconnecting a site stops that connection in your wallet interface. It does not cancel an on-chain allowance. The spender can still move approved tokens until you revoke or reduce the allowance.
Do token approvals expire?
Official Ethereum.org guidance is that these contract permissions do not expire. A permission granted years earlier can still be used until you overwrite or revoke it.
Does revoking a token approval close my staking or lending position?
According to Ethereum.org, revoking token access does not terminate staking, pooling, or lending positions. You remain in those positions, but you will need a new approval the next time that protocol needs to move the token.
Why does revoking cost gas?
A revocation is a new on-chain transaction that overwrites the allowance, so the network charges a fee. Check current fee conditions before you send it, and never treat a lower fee as a reason to skip reading the spender and amount.
Can I recover tokens after a malicious spender drains an allowance?
Confirmed cryptocurrency transfers are typically not reversible. Save the transaction hash and report the incident through official channels. Treat anyone promising guaranteed recovery for an upfront fee as another risk.
Evidence reviewed August 18, 2026
Primary sources
Approval mechanics were checked against the ERC-20 specification. Review and revoke steps were checked against the current Ethereum.org user guide, Ethereum.org security guidance, and the current MetaMask help article. Wallet screens and explorer tools change, so re-open those pages before you sign a high-value approval or revocation.
- ERC-20 — approve, allowance, and transferFrom
- Ethereum.org — how to revoke smart contract access to your crypto funds
- Ethereum.org — security guidance on unlimited spend limits
- MetaMask Help Center — revoking smart contract allowances and token approvals
- Etherscan — token approval checker listed by Ethereum.org and MetaMask
- U.S. Federal Trade Commission — cryptocurrency payments and recovery limits