Connecting a wallet lets a decentralized application see a public address. A token approval is different: it can authorize a smart contract to move a specified ERC-20 token from that address up to an allowance. Swaps, lending deposits, and liquidity positions often need an approval, which is why the right response is review—not panic or blind signing.
Read the approval before you sign
Check the network, the token, the spender address, and the amount. An unlimited allowance is convenient because it avoids later approval transactions, but it also leaves broader permission if the spender is compromised or malicious. A limited amount can reduce exposure, although it may require another approval later.
Connecting is not approving
Disconnecting a dapp removes a connection, but it does not revoke an existing token allowance. Conversely, revoking an allowance changes the on-chain permission; it costs a network fee and must be confirmed in a wallet. These are separate actions, and mixing them up can leave a risky approval in place.
A practical approval-review routine
- Open the official block explorer for the correct network or your wallet’s approval tool.
- Review token, spender contract, amount, and the app that requested it.
- Verify a suspicious spender address from the protocol’s official documentation, not from a sponsored result or a chat message.
- Revoke allowances you no longer need, recognizing that each revocation is an on-chain transaction.
- Repeat after trying unfamiliar dapps or after any suspicious interaction.
What revoking cannot fix
Revoking blocks future transfers under that specific allowance. It cannot undo tokens that were already sent, reverse a transaction you signed, or secure a recovery phrase that has been disclosed. If a recovery phrase is exposed, move remaining assets to a new wallet generated from a new phrase as safely as possible.
Use the same caution for signatures
Some requests are signatures rather than legacy on-chain approvals. Do not treat a signature prompt as harmless just because it may not show a gas fee. Verify the site, the request, and the account used. Never share a recovery phrase, and do not fund a wallet that appears to offer “free” tokens through a shared phrase: that is the pattern behind the seed phrase gas scam.
Sources and further reading
- MetaMask: revoke smart-contract allowances
- MetaMask: what token approvals are
- MetaMask: manage dapp permissions
This article is for educational information only and is not personal investment advice.
