What Is a Token Approval?

Imagine handing a parking valet a copy of your car key - one that only starts the engine and drives, but can't open the trunk or glovebox. You're trusting them to use it once, for one job, and hand the car back.

A token approval is like handing out that key, except by default it usually doesn't expire, and the valet can use it as many times as they want, whenever they want - until you take the key back yourself.

Tokens like USDC or UNI aren't held or moved by an app the way ETH is - a smart contract can only spend those tokens on your behalf if you've explicitly given it permission first. That permission is called an approval.

Practically, this means every time you swap a token on an exchange, deposit into a lending protocol, or add liquidity to a pool, the app first asks you to approve its contract to spend a specific token from your wallet. You'll usually see this as a separate “Approve” transaction, before the actual swap or deposit.

Approvals let apps move your tokens in a later transaction without asking for a fresh signature every single time. Instead of approving an exact amount every time you trade, many apps request approval for a very large (often effectively unlimited) amount once, so future transactions with that app are one click instead of two.

An unlimited approval doesn't expire and doesn't track how much you actually intended to spend - it just keeps standing permission to move that entire token balance, indefinitely. That's convenient, but it also means:

• If the app's contract is ever exploited, an attacker can drain any token you've unlimited-approved to it - not just what you meant to trade.
• Old approvals to apps you've long since stopped using often sit active for years, quietly increasing your exposure.
• You have no way to tell, just by looking at your wallet balance, which contracts currently have this kind of standing access.

None of this means approvals are inherently unsafe - they're how most of DeFi works. It just means unused or unrecognized approvals are worth cleaning up periodically, the same way you'd cancel a subscription you forgot you had.

Look up your own address with Wallet Lookup and open the Active Approvals section - it lists every contract currently permitted to spend your tokens, flags which ones are unlimited, and links out to Revoke.cash, the tool actually used to revoke them (revoking requires signing a transaction from your own wallet - no site can do it for you, including this one).

A good rule of thumb: if you don't recognize the contract, or haven't used the app in months, there's little downside to revoking it and re-approving later if you ever come back.