Revoke.cash has become an essential tool for anyone interacting with DeFi protocols, and the November 2023 KyberSwap exploit that drained $56 million from liquidity providers made its importance impossible to ignore. When you connect your wallet to a decentralized application and approve a token spending limit, you are granting that smart contract permission to move your tokens — often in unlimited amounts. If that contract is later exploited, the attacker can use those pre-approved permissions to drain your wallet entirely. This advanced tutorial walks you through how token approvals work, how to audit them, and how to build a systematic approval management workflow that protects your assets across every chain you use.
The Objective
By the end of this tutorial, you will understand the ERC-20 approve mechanism at the smart contract level, know how to audit all active token approvals across multiple blockchains, be able to revoke risky or unnecessary approvals efficiently, and implement a recurring approval hygiene practice that minimizes your exposure to exploit-driven wallet drainage. This is not a beginner guide — it assumes you are already using DeFi protocols and understand wallet basics. With Bitcoin at $37,254 and Ethereum at $2,027 in late November 2023, even a small approval oversight can result in losses worth thousands of dollars.
Prerequisites
Before starting, ensure you have the following. A Web3 wallet installed (MetaMask, Rabby, or Coinbase Wallet). Your wallet connected to at least one EVM-compatible network (Ethereum, Arbitrum, Optimism, Polygon, BSC, or Avalanche). Basic familiarity with Etherscan or your preferred block explorer. A browser with Revoke.cash opened. Optionally, a hardware wallet for signing transactions securely. You should also have a small amount of native tokens (ETH, MATIC, BNB) on each network you use to pay for gas fees associated with revoking approvals. Revoking is an on-chain transaction and costs gas, though typically much less than a standard token transfer.
Step-by-Step Walkthrough
Step 1: Connect your wallet to Revoke.cash. Navigate to revoke.cash and click “Connect Wallet.” Select your wallet provider and approve the connection. Revoke.cash is a read-only tool — connecting does not grant any spending permissions. The interface will automatically detect which network your wallet is connected to and display all active approvals for that chain.
Step 2: Review your active approvals. For each token, you will see a list of smart contract addresses that have spending permissions, along with the approved amount. Pay special attention to approvals labeled “Unlimited” — these represent the highest risk. The approval amount is displayed in the token’s native unit, so an unlimited USDT approval means that contract can theoretically transfer your entire USDT balance. Sort by risk level: prioritize revoking approvals for contracts associated with protocols you are no longer actively using.
Step 3: Identify high-risk approvals. Cross-reference contract addresses with DeFi Llama or the protocol’s official documentation. If you do not recognize a contract, or if it belongs to a protocol that has been exploited or abandoned, revoke immediately. The KyberSwap Elastic exploit specifically targeted liquidity pools — any user who had approved token spending to KyberSwap Elastic contracts was at risk. Check for approvals to bridge contracts, DEX routers, and lending protocols you have not used in the past 30 days.
Step 4: Revoke unnecessary approvals. Click the “Revoke” button next to each approval you want to remove. Your wallet will prompt you to confirm a transaction — this is a standard on-chain transaction setting the approval to zero. Confirm the transaction and wait for it to be included in a block. The gas cost is typically minimal. Repeat this process for every chain you use by switching your wallet network and refreshing Revoke.cash.
Step 5: Implement approval hygiene going forward. When interacting with new protocols, use the “Edit Permission” or “Custom Spending Limit” option in your wallet to set specific approval amounts rather than accepting the default unlimited approval. Most protocols function perfectly well with approvals set to the exact amount you intend to deposit. For protocols you use frequently, set a reasonable limit — perhaps twice your typical transaction size — rather than unlimited. Make a calendar reminder to audit your approvals monthly, or after any major DeFi exploit is reported in the news.
Troubleshooting
If Revoke.cash does not load your approvals, ensure your wallet is connected to the correct network. Some lesser-known chains may not be supported — in that case, use the block explorer directly by navigating to your wallet address, finding the ERC-20 token approvals section, and manually revoking through the token contract’s “Approve” function with a zero amount. If a revoke transaction fails due to insufficient gas, add more native tokens to your wallet and retry. For approvals that appear revoked but still show in the interface, clear your browser cache and reconnect. If you suspect a compromised approval, move your tokens to a fresh wallet address immediately as a precautionary measure — this is faster than waiting for revocation transactions to confirm.
Mastering the Skill
Advanced users should consider automating approval management. Tools like Tenderly allow you to set up alerts that notify you when new approvals are created on your wallet address. You can build a monitoring dashboard that tracks all active approvals across chains and flags new ones for review. For protocol developers, consider implementing “approval expiration” — smart contracts that automatically reduce approval amounts after a set time period. This pattern, combined with per-transaction approval limits, would significantly reduce the blast radius of future exploits. The KyberSwap incident showed that even sophisticated DeFi users can be caught off guard. Systematic approval hygiene is the difference between reading about an exploit and being its victim.
Disclaimer: This article is for educational purposes only and does not constitute financial or investment advice. Always verify smart contract addresses through official channels and conduct your own security research.
56M drained from kyberswap and people still leaving unlimited approvals in 2026. nothing changes. revoke.cash bookmarked but half the battle is remembering to use it
47 unlimited approvals on 5 chains is crazy. i ran revoke.cash after kyberswap and found approvals to contracts that rugged 2 years ago lol
cosign_eu the stale approval problem is massive. people focus on new exploits but forget that a contract from 2022 can still drain your wallet today
revoke.cash is non-negotiable at this point. if you have more than 5 active approvals on any chain you are begging to get drained
metamask burying the custom spend limit feature is the real UX crime here. it exists but they make you dig for it
unlimited approvals are the original sin of DeFi UX. wallets should default to exact-amount approvals but that would add a click so nobody does it
^ metamask actually added a feature to set custom spend limits but its buried in the UI. most people just click approve without reading
unlimited approvals are the original sin of DeFi UX. wallets should default to exact-amount approvals but that would add a click so nobody does it
Ines G. wallets will never default to exact amounts because dApps lobby against it. unlimited approvals reduce transaction count which means more TVL which means more fees
wallets will never default to exact amount approvals. dApps fund development through unlimited approvals driving transaction volume
exact_amount_only_ nailed it. dApps actively lobby against exact approvals because more clicks means lower conversion. user safety gets sacrificed for TVL numbers
dApps fighting exact-amount approvals because it adds friction is the most defi-brained take. one $56M exploit erases years of UX gains
the ERC-20 approve mechanism was designed for convenience, not security. the KyberSwap LPs who got drained probably approved unlimited USDC months ago and forgot about it
set a calendar reminder to revoke unused approvals every 2 weeks. takes 5 minutes and saves you from exactly this scenario
the 2 week calendar reminder is underrated advice. most people only check after they see an exploit headline and by then its already too late
the 2 week calendar reminder advice is the most practical thing in this entire guide. set it and forget it until something blows up
revoke.cash saves you exactly once and then you forget about it for 3 months. discipline issue not a tooling issue
the real problem is stale approvals from 2022 that nobody remembers. been on 7 chains since defi summer and i probably have 200+ active approvals scattered around
checked my wallet after kyberswap and found 47 unlimited approvals dating back to 2021 across 5 chains. revoke.cash took 20 minutes
found 31 unlimited approvals on optimism alone after the kyberswap news. two were from contracts that dont even exist anymore lmao
the real nightmare is approvals across 8+ chains. revoke.cash helps but tracking what you approved on moonbeam in 2022 is basically archaeology
KyberSwap LPs had unlimited approvals sitting there for months. the exploit was on November 27 and people probably still had the same approvals in December
rug_approval_ lol the dead contract approvals are so real. I found 14 approvals on Polygon from 2021 projects that rugged in weeks
Colm B. the UX argument is such a trap. exact-amount adds one extra click and prevents total wallet drainage. defi teams choosing convenience over safety is why exploits keep happening
the 56M KyberSwap drain was preventable with a single spend limit toggle. revoke.cash is treated as optional when it should be mandatory after every dApp interaction