If you use MetaMask to interact with DeFi, you will give token approvals. Those approvals are not a setting inside the wallet alone — they are on-chain permissions that let a smart contract move tokens from your address. I’ve had to clean up careless approvals more than once. What I’ve found is that most problems come from mixing up "disconnecting a site" and "revoking an on-chain allowance." This guide explains both, how to revoke token approvals with MetaMask, and practical tips so you don’t pay more gas than necessary.
On EVM-compatible blockchains, most tokens follow an allowance model: you call approve(spender, amount) and the token contract sets an allowance that lets the spender call transferFrom on your balance. Approvals can be set to a specific amount or to a very large number (often called an "unlimited token allowance").
Approvals live on-chain. That means removing them also requires a transaction. And yes, that costs gas.
Approvals are convenient. They let a DEX or lending protocol move tokens for swaps or deposits without a new approval every time. But convenience has a cost. Approving an unlimited allowance to the wrong contract is the easiest way to lose tokens to a malicious or compromised smart contract.
Real example: I once approved an unlimited allowance to a router contract while testing swaps. Later the router’s approval was used in a malicious contract call (not the router itself, but an exploit of its connected contracts). I had to revoke that approval immediately and accept the gas hit.
Unlimited token allowance MetaMask warnings do exist in places, but they don’t prevent you from approving.
People conflate two actions:
Disconnecting is free and quick. Revoking costs gas and must be signed. Which do you need? Both, sometimes. If you don’t intend to use a dApp again, disconnect it in MetaMask and revoke any approvals it still holds.
See the related guides: connect to dApps and revoke approvals.
This is a practical, step-by-step workflow for reclaiming control.
But don’t forget: if approvals were made on multiple chains or L2s, repeat this process per network.
If you need a visual walkthrough, check our step guide: how to revoke token approvals.
| Method | Ease | Gas cost | On-chain effect | Best for |
|---|---|---|---|---|
| In-wallet disconnect (MetaMask) | Very easy | Free | No — local only | Stopping future site pop-ups |
| On-chain revoke via permission manager | Moderate | Yes (per tx) | Sets allowance to 0 | Removing approvals quickly |
| Manual contract interaction (approve 0) | Advanced | Yes | Same as revoke | When UI tools fail or for custom tokens |
Desktop extension is faster for bulk review because tool UIs are easier to read. Mobile can do the job but the small screen makes managing many approvals tedious.
If you use WalletConnect or the in-app browser, remember that connecting a dApp on mobile still requires a signature via MetaMask. The revocation flow is identical, but confirmations and gas-editing may feel clunky.
See tips for mobile connections: walletconnect and mobile browser.
And if you rely on a hardware device for signing, use it to approve revocation transactions (see hardware best practices).
Who MetaMask fits:
Who should look elsewhere or add tools:
Q: Is it safe to keep crypto in a hot wallet?
A: Hot wallets are convenient but inherently riskier than cold storage. Keep only the funds you need for daily DeFi activity in MetaMask. For everything else, use cold storage or a multisig. See security best practices.
Q: How do I revoke token approvals?
A: Copy your address, use an allowance manager or on-chain explorer to list approvals, connect with MetaMask, and submit a revoke (approve 0). Follow the step-by-step above and our how-to: how to revoke token approvals.
Q: What happens if I lose my phone?
A: Losing a device doesn’t lose funds if you have your seed phrase (recovery phrase) and kept it secure. If someone gets both your phone and recovery phrase, they can drain funds — backup safely. See backup and recovery options.
Q: Can revoked approvals be undone?
A: Yes. You can approve a spender again. Revoking is simply another on-chain transaction that changes the allowance.
Approvals are a core part of using DeFi with MetaMask. They offer convenience, but they also expose you to smart contract risk. In my experience, periodic cleanup of approvals is a small time investment that removes a big attack surface.
Actionable next steps: disconnect unused sites in MetaMask, scan your account for approvals, and revoke any unlimited allowances you don’t actively use. If you want a guided walk-through, see revoke approvals and how to revoke token approvals.
But don’t stop there — combine this routine with good backups and hardware signing for large balances. And always double-check contract addresses before approving anything.