How to Check and Revoke Crypto Token Approvals (and Why Disconnecting Isn't Enough) (2026)
How do you check and revoke crypto token approvals?
A token approval is a permission you signed that lets a smart contract spend a token from your wallet. It doesn't expire on its own. To check yours, open an approval checker such as Revoke, or the token approval tool on a block explorer. Connect the wallet on the same network you used, review each contract and its spending limit, and revoke any you don't recognise or no longer use. Each revoke is an on-chain transaction, so you pay a small network fee. Disconnecting a wallet from a site doesn't remove its approvals. This guide shows how to read the list, what to revoke first, and how this connects to using CoinDrop and Swappr safely.
Security guidance, not financial advice. Wallet and tool screens change; follow what your own wallet shows.
What an approval actually lets a contract do
On Ethereum and compatible networks, tokens follow the ERC-20 standard. Its approve function lets a "spender" withdraw from your account up to a set allowance, as many times as it likes, until the allowance is used up or changed. Apps ask for this so they can move your tokens for you, for example a DEX pulling the token you're swapping.
The danger is in the size and the lifetime. ethereum.org's guide warns that many platforms ask for unlimited allowances to save small fees later. Once a contract has unlimited access to a token, it can spend all of that token in your wallet, even after you've withdrawn from its platform. If the contract is malicious or gets compromised, the tokens can be drained with no recovery path.
Four steps to check and revoke
- Open an approval checker. ethereum.org lists Etherscan and Blockscout (Ethereum), and Revoke, Unrekt and EverRevoke (multiple networks). Type the address yourself or use a bookmark. Don't follow links from DMs or ads.
- Connect on the right network. You only see approvals for the network you're connected to. Approvals on Ethereum mainnet don't show when you're on Polygon, for example. Repeat for each network you've used.
- Review each entry. Each line shows a token, a spender contract and an allowance. Revoke anything unlimited that you're no longer using, anything you don't recognise, and anything linked to a project that's shut down or been hacked.
- Confirm and recheck. Your wallet asks you to sign a revoke transaction and pay its fee. After a few minutes, reload the tool to check that the approval has gone.
Revoking doesn't move your tokens. ethereum.org also notes that it doesn't end staking, pooling or lending positions you've already entered. The cost is convenience: next time you use that app, it will ask for approval again.
Disconnecting is not revoking
This is the most common misunderstanding. "Connected sites" in your wallet controls which websites can see your address and ask you to sign. Approvals are stored on the blockchain, in the token contract itself. Disconnecting a site stops it from requesting new signatures, but any approval you already granted stays on-chain until you revoke it or it's used up.
| Action | What it changes | Costs gas? |
|---|---|---|
| Disconnect a site | The site can no longer see your address or prompt you | No |
| Revoke an approval | The contract can no longer spend that token | Yes, a normal transaction fee |
| Lower an approval | The contract can spend only the smaller allowance | Yes |
On Solana: delegates
Solana tokens don't use ERC-20 approvals, but they have something similar. Solana's token documentation describes a delegate: another address allowed to transfer or burn a limited amount from one of your token accounts. Each token account holds one delegate at a time, and approving a new one replaces the old one. The owner can revoke the delegate with a separate instruction. If a Solana app asked you to approve a delegate, check your wallet's security or token settings for a way to revoke it.
What this means for CoinDrop and Swappr
Neither of our apps needs you to approve a token spender, and knowing that turns into a useful scam check:
- Swappr creates a swap order. You then send coins from your own wallet to the deposit address, and that's a plain transfer. There's no approval to sign and no "connect wallet" step.
- CoinDrop is a daily-rewards app. Its rewards are tied to a token on Solana, whose mint address the CoinDrop site publishes. Joining doesn't involve signing a wallet approval.
So if a site or message claims to be CoinDrop or Swappr and asks you to "connect wallet and approve" to claim, unlock or speed something up, treat it as a drainer. Our guide to spotting fake free-crypto offers lists the other warning signs. Before you approve any contract, verify its contract address.
If you think you already approved a drainer
Speed matters more than anything else here. An approval stays active until it's used or revoked, so the steps are in order of urgency:
- Revoke the approval first. Use the four steps above on the network where you signed. Revoking needs a small amount of the network's gas coin, so keep some in the wallet.
- Move what's left to a fresh wallet. If you also typed your recovery phrase anywhere, revoking isn't enough. Whoever has the phrase controls the whole wallet. Create a new wallet with a new phrase and move the funds there.
- Check every network you use. Approvals are per network. A scam that hit you on one chain may have asked for approvals on another too.
- Ignore "recovery" offers. People who message you offering to get stolen crypto back for a fee are usually running a second scam on the same victim.
Tokens already moved by a drainer can't be pulled back by revoking. Revoking only stops further transfers, which is why acting quickly helps.
A simple routine that keeps approvals small
- Approve exact amounts. Many wallets let you edit the spending limit before you sign. Set it to what you're actually swapping.
- Use a separate wallet for experiments. Keep long-term holdings in a wallet that never connects to new apps. Our six steps to set up a self-custody wallet cover the backup.
- Review monthly, and after any scare. If you clicked something odd, check approvals first, then think about moving funds to a fresh wallet.
- Read the signature screen. Words like "approve", "set approval for all" or "permit", or an unlimited amount, mean you're granting spending rights, not just logging in.
FAQ
Do token approvals expire?
No. An ERC-20 allowance stays until it's used up, changed or revoked. That's why ethereum.org recommends revoking unused approvals regularly.
Does revoking an approval cost money?
Yes, a normal network fee, because the revoke is an on-chain transaction. On busy networks it costs more, so start with the unlimited and unknown approvals.
Will revoking affect my staking or my tokens?
No. According to ethereum.org, revoking doesn't affect staking, pooling or lending positions, and it doesn't move your tokens. The app will just ask for approval again next time.
Do CoinDrop or Swappr ever ask for a token approval?
No. Swappr deposits are plain transfers you send yourself, and joining CoinDrop doesn't involve a wallet approval. An approval request in their name is a red flag.
Sources
- ethereum.org: how to revoke smart contract access to your crypto funds (checked 2026-10-27)
- EIP-20: Token Standard (approve and allowance) (checked 2026-10-27)
- Solana docs: approve a token delegate (checked 2026-10-27)
- Revoke.cash: what are token approvals (checked 2026-10-27)