Approval revocation

The ERC-20 standard exposes three key functions. approve(spender, amount) authorizes a contract to spend, allowance(owner, spender) checks how much remains authorized and transferFrom(owner, to, amount) executes that spend. Revoking means calling approve(spender, 0): the same function with a zero amount. For NFTs (ERC-721 and ERC-1155) the equivalent is setApprovalForAll(operator, false), which withdraws permission over an entire collection. Each revocation is an on-chain transaction, costs gas and must be done per token and contract pair.

The root risk is unlimited approvals (allowance set to the maximum of 2^256-1), the default pattern many dApps use to avoid prompting a signature on every operation. If the authorized contract turns out to be malicious or gets exploited, it can drain the entire balance of that token. That is why revocation is recurring security hygiene. It shrinks the attack surface by withdrawing old or forgotten permissions from unused dApps, a passive theft vector, and is worth doing after trying any new application.

The reference tools are Revoke.cash, which connects the wallet and lists every active approval by token and contract across multiple chains, and Etherscan's Token Approvals checker, under its More menu. Other options include DeBank and Unrekt. Revocation is the direct countermeasure against a wallet drainer, which abuses precisely approvals and signatures. Keep its limit in mind: if the private key is compromised, revoking is not enough, because the attacker can simply sign again.