Unlimited token approvals: what they are and how to revoke them

The first time you use a DeFi app, a wallet popup often asks you to "approve" a token before anything else happens. Many people click through without knowing what they just signed. This page explains what an approval is, what "unlimited" means, and how to check what your own wallet has approved.

An approval is a permission, not a payment

On Ethereum and other EVM chains, a token like USDC lives in its own smart contract. For an app such as an exchange or lending protocol to move your tokens, you first have to give it permission by sending an approve transaction. That transaction moves no money. It records: "this contract may spend up to X of my USDC."

After that, the approved contract can pull those tokens from your wallet whenever it wants, up to the allowed amount, without asking you again. Approvals are per token, per contract and per chain. Approving USDC on Ethereum for one app says nothing about USDT, another app, or another chain.

What “unlimited” means

The allowed amount is just a number. "Unlimited" means the app asked for the largest number the token contract can store (2²⁵⁶ − 1), far more than anyone owns. Apps do this because it saves you a transaction, and its gas fee, every time you use them.

With an unlimited approval the cap no longer protects you. The contract can take your entire balance of that token, including tokens you receive later, until you revoke the permission.

When is it a real risk?

• The contract is malicious. Phishing sites ask for approvals to a contract the scammer controls. Once granted, they can drain the token.
• The contract gets exploited. Even a legitimate protocol can be hacked, and an attacker can then use every allowance users ever granted it.
• You forgot about it. Approvals do not expire. One granted years ago to an app you no longer use is still active.

How to see your approvals in Hopchain

Paste your address on the home page, open a connection in the list and expand it with the small arrow. Approvals your wallet granted are shown separately from transfers, with the token, the amount, and the spender. Unlimited ones say "Unlimited", and spenders we recognise are labeled by name.

For example, one public wallet's history contains an approval of about 396,667 USDC to "CoW Protocol: GPv2VaultRelayer" on Ethereum in August 2023, a finite amount, shown in the expanded USDC connection of that wallet.

Hopchain shows approvals that appear as on-chain Approval events in transactions your wallet sent. It is not a full list of every allowance currently active, so use a dedicated approval checker before deciding what to revoke.

How to revoke an approval

1. Open an approval checker such as Etherscan's Token Approval Checker or Revoke.cash and connect or enter your address. Only ever use the official site, and never enter a seed phrase.
2. Find approvals to contracts you no longer use or do not recognise.
3. Send the revoke transaction. It sets the allowance back to zero and costs a normal gas fee, once per token and contract.

Revoking does not affect your tokens. If you use the app again later, it will simply ask for a new approval.

Good habits

• If an app offers to set the exact amount, prefer that, especially with contracts you do not know well.
• Read the popup: the name of the spender contract and the amount are shown.
• Revoke approvals you no longer need every so often.
• Keep only what you need on wallets you use with new or risky apps.

Related: fake airdrops and spam NFTs, a common way people get tricked into signing a harmful approval.

This is general information, not financial or security advice.