Approval risk self-check

Approvals are sign-once, live-indefinitely. No interface anywhere will tell you "you currently have several dozen outstanding permissions", so this only happens if you go and look.

SeedKnot editorial Runs locally · no network Updated 26 Aug 2026

Illustration: what, where, revoke and how often arranged on a seed-card grid

The automatic verdict needs JavaScript. Without it you can still read every item; you simply will not get a summary.

I have never checked which approvals I have granted
The most common item on this list. Approvals do not expire, do not remind you and do not shrink with time. Never having looked means you have no idea how large your exposure is.
I connect to sites with the same wallet that holds most of my assets
This is structural and worse than any single approval. Without separating purposes, the ceiling on one bad decision is everything you own. Separate them and the ceiling becomes whatever is in the small wallet.
I have never adjusted an allowance, I just press confirm
Many applications request an enormous default, meaning "the entire balance of this token, including whatever arrives later". Most wallets let you edit that figure down to what the operation actually needs.
I have joined distributions or on-chain campaigns and never cleaned up afterwards
Campaign pages are where malicious approvals concentrate, and the permission is usually one-off by nature — once you are done there is upside in keeping it and only downside.
I have signed gasless requests without understanding the content
Costing no gas only means it did not go on-chain then. Some off-chain signatures describe an authorisation or a transfer, and whoever holds the signature can submit it later at their own expense while your assets move.
I have used this address on several chains but only reviewed one
Approvals are recorded per chain. Clearing one leaves the others exactly as they were — possibly including chains where you no longer remember what you did.
I have used applications that are no longer maintained or have shut down
Safe today does not mean safe forever. Once a project stops, nobody fixes its vulnerabilities, and your approval is still there. These are priority revocations.
I have never verified the contract address on an approval screen
A cloned site looks identical and its domain differs by a character or two; the substantive difference is that contract address. Checking it works far better than judging the page by appearance.

02Where to look, and in what order to act

Use a dedicated approval management site and paste your address in — looking does not require connecting a wallet — or use the token approval page on that chain's block explorer. Check each chain separately.

Work down by risk:

What to revoke first
What you see	Action
Unlimited allowance, contract you do not recognise	Revoke now
Something you never deliberately approved	Revoke now, and consider moving the assets
Unlimited allowance, application long unused	Revoke; re-approve if it ever comes up
An approval on a token you hold a lot of	Revoke, or cap the allowance
Capped allowance, small figure	Leave it
Mature application you use often	Keep, but add to the next review

Revoking is an on-chain transaction and costs a network fee. With many entries, handle only the high-risk ones or batch them when the network is quiet. Full walkthrough with a screenshot in checking and revoking approvals.

03Which approval types carry the most risk

In order: unlimited allowances, then any approval to an unfamiliar contract, then off-chain signatures you did not understand, then capped allowances. The first two deserve clearing first.

Unlimited allowances. They do not decrease with use and they cover balances you have not received yet. If the contract fails, that token can go entirely.
Approvals to unfamiliar contracts. You cannot assess what the code does, and you cannot predict whether it will be compromised later.
Off-chain signatures you did not read. Potentially equivalent to an approval, with no on-chain record for you to review afterwards.
Capped allowances. Loss has a ceiling; the most manageable of the four.

The mechanics behind each are in signatures and approvals.

04What this checklist does not cover

Only token approvals. A leaked seed phrase, a counterfeit wallet app, a swapped clipboard address, sending to the wrong destination — none of those are approval problems, and clearing approvals does nothing for them.

One point especially: if your seed phrase may already be exposed, revoking approvals is pointless — whoever holds it can simply transfer, without needing permission from anyone. In that situation the only effective action is moving assets to a brand new, properly backed-up wallet.

The full list of other routes is in how wallets actually get drained; to audit seed phrase storage, use the seed backup self-check.

05Common questions

Do I need to connect a wallet to check approvals

Not to look. Most approval managers let you paste an address and query it, showing the same information. A wallet connection is only needed to execute a revocation and sign it.

Can I keep using an application after revoking its approval

Yes. The next time you use it, it will request approval again and you confirm once more. Revoking does not affect the assets you hold; it only withdraws a permission.

Does this checklist save my answers

No. Tick state exists only in the current page's memory, with no cookies, no local storage and nothing sent anywhere. Refreshing clears it.

Which is worse, an approval problem or a leaked seed phrase

A leaked seed phrase, by a wide margin. It compromises every address and every chain under that wallet and cannot be contained by revoking — the whole wallet has to be abandoned. Approval problems usually affect specific tokens and can be revoked.