Token Approval Checker

A token approval checker reads onchain permissions that let spender contracts move ERC-20 tokens or NFTs from a wallet; approvals are chain-specific and remain active after the wallet disconnects from a site.

Token approval checker tools

Use a known explorer or established revocation interface, opened from a bookmark:

Never search for a revocation site during an incident and click the first ad. A fake approval checker can request the exact malicious signature it claims to remove.

How to check token approvals

1. Open the checker from a saved official URL.
2. Enter the public address without connecting first, when supported.
3. Select one chain and inspect ERC-20, ERC-721, ERC-1155, and Permit2 tabs.
4. Match each spender address to a verified contract and protocol source.
5. Flag unlimited, dormant, unknown, and upgradeable spenders.
6. Repeat on every chain where the address has activity.
7. Connect only when ready to submit a specific revocation.

The token contract and spender contract are different fields. The token holds the allowance; the spender is the address allowed to use it.

ERC-20 approval checker results explained

EIP-20 defines approve(spender, amount) and allowance(owner, spender). A large allowance is not an immediate transfer. It is authority the spender may exercise while the wallet has a balance in that token.

Risk depends on four facts:

• allowance size;
• current and future wallet balance;
• spender contract behavior and upgradeability;
• whether the spender is still needed.

An unlimited approval to a widely used router can reduce repeated gas, but it expands loss if that router or its admin is compromised. For an activity wallet, convenience rarely justifies approvals that outlive the campaign.

Permit2 and signature approvals

Do not stop at standard allowances. Permit2 separates permission into two layers:

1. the token owner approves the Permit2 contract onchain;
2. signed messages authorize particular spenders, amounts, and expirations through Permit2.

EIP-2612 permits allowances through signatures submitted onchain by another party. A wallet prompt can therefore create spending authority without the user directly sending a conventional approve transaction.

Read the spender, token, amount, nonce, chain, and deadline in any typed-data signature. "Sign to verify" is not a harmless category.

How to revoke token approvals

A revocation sets an allowance to zero or removes an operator permission. It is an onchain transaction and costs gas.

Before confirming:

• verify the chain and revocation target in the wallet;
• confirm the transaction calls the token, NFT, or permission contract you inspected;
• avoid batch signatures whose individual calls are hidden;
• wait for confirmation, then refresh the checker;
• record the revocation hash.

Revoking can break open orders, recurring deposits, vault automation, or protocol withdrawals. Understand the dependency, but do not retain an unexplained permission merely because an interface warns that something may stop working.

Which crypto approvals should you revoke?

Priority order:

1. unknown spender with nonzero allowance;
2. spender linked to an incident or phishing domain;
3. unlimited allowance for an asset the wallet still holds;
4. dormant protocol or completed campaign;
5. duplicated legacy router after a migration;
6. active spender whose limit materially exceeds intended use.

Our rule: approvals need an owner and an expiry decision. If you cannot name the application, purpose, and next use, revoke it.

If a seed phrase or private key was exposed, approval cleanup is not enough; move to a new seed generated on a clean device and retire the old wallet. Follow the triage in digital wallet scam and track permissions in the crypto tracking spreadsheet.

Sources

• EIP-20 token standard
• EIP-2612 permit extension
• Uniswap Permit2 overview