Smart Contract Approvals & Token Allowances

Smart Contract Approvals & Token Allowances (MetaMask)

If you use MetaMask to interact with DeFi, you will give token approvals. Those approvals are not a setting inside the wallet alone — they are on-chain permissions that let a smart contract move tokens from your address. I’ve had to clean up careless approvals more than once. What I’ve found is that most problems come from mixing up "disconnecting a site" and "revoking an on-chain allowance." This guide explains both, how to revoke token approvals with MetaMask, and practical tips so you don’t pay more gas than necessary.

Overview: what token approvals do

On EVM-compatible blockchains, most tokens follow an allowance model: you call approve(spender, amount) and the token contract sets an allowance that lets the spender call transferFrom on your balance. Approvals can be set to a specific amount or to a very large number (often called an "unlimited token allowance").

Approvals live on-chain. That means removing them also requires a transaction. And yes, that costs gas.

Why approvals matter (and what can go wrong)

Approvals are convenient. They let a DEX or lending protocol move tokens for swaps or deposits without a new approval every time. But convenience has a cost. Approving an unlimited allowance to the wrong contract is the easiest way to lose tokens to a malicious or compromised smart contract.

Real example: I once approved an unlimited allowance to a router contract while testing swaps. Later the router’s approval was used in a malicious contract call (not the router itself, but an exploit of its connected contracts). I had to revoke that approval immediately and accept the gas hit.

Unlimited token allowance MetaMask warnings do exist in places, but they don’t prevent you from approving.

Disconnect dApps vs revoke token approvals

People conflate two actions:

• Disconnecting a dApp (in-wallet "Connected sites") removes the website’s ability to request future connections. It’s a local permission recorded by the wallet UI.
• Revoking a token approval is an on-chain transaction that sets the allowance back to zero (or a safer amount). It prevents an approved contract from moving tokens even if it can still connect to your wallet.

Disconnecting is free and quick. Revoking costs gas and must be signed. Which do you need? Both, sometimes. If you don’t intend to use a dApp again, disconnect it in MetaMask and revoke any approvals it still holds.

See the related guides: connect to dApps and revoke approvals.

Step-by-step: How to revoke token approvals with MetaMask

This is a practical, step-by-step workflow for reclaiming control.

1. Copy your wallet address from MetaMask (click account name to copy).
2. Use a token-approval manager or an on-chain permission viewer (connect with MetaMask). These tools list current allowances per token and spender. (If you prefer not to connect, use a blockchain explorer that lists token approvals by address.)
3. Review each approval: token, spender address, and whether it’s flagged as "unlimited." If you don’t recognize the spender, revoke it.
4. Revoke: click "revoke" or set allowance to 0. MetaMask will pop up to sign the transaction. Confirm gas settings (see gas fees and EIP-1559).
5. If a token requires it, first set allowance to 0, then set a lower allowance (some ERC-20 implementations reject direct changes).
6. Wait for confirmation and verify the allowance is gone.

But don’t forget: if approvals were made on multiple chains or L2s, repeat this process per network.

If you need a visual walkthrough, check our step guide: how to revoke token approvals.

Quick comparison: methods to revoke allowances

Method	Ease	Gas cost	On-chain effect	Best for
In-wallet disconnect (MetaMask)	Very easy	Free	No — local only	Stopping future site pop-ups
On-chain revoke via permission manager	Moderate	Yes (per tx)	Sets allowance to 0	Removing approvals quickly
Manual contract interaction (approve 0)	Advanced	Yes	Same as revoke	When UI tools fail or for custom tokens

Mobile vs Desktop: UX differences

Desktop extension is faster for bulk review because tool UIs are easier to read. Mobile can do the job but the small screen makes managing many approvals tedious.

If you use WalletConnect or the in-app browser, remember that connecting a dApp on mobile still requires a signature via MetaMask. The revocation flow is identical, but confirmations and gas-editing may feel clunky.

See tips for mobile connections: walletconnect and mobile browser.

Common pitfalls and advanced tips

• Some tokens require a two-step change: set to 0, then set to the new amount. If a revoke tx fails, try the two-step method.
• Watch for identical-looking spender addresses. Copy and paste the contract address into a block explorer before revoking (or approving) anything.
• Revoking costs gas on the relevant chain. If mainnet gas is high, prioritize revoking the riskiest approvals first. But don’t let gas costs stop you from removing dangerous allowances.
• For repeated interactions, consider approving a specific small amount instead of an unlimited allowance.
• Smart contract wallets and account abstraction can use session keys and per-dApp limits to reduce approval risk. In my experience, smart-contract accounts reduce repeated approval friction but add complexity.

And if you rely on a hardware device for signing, use it to approve revocation transactions (see hardware best practices).

Who should use MetaMask for allowance management

Who MetaMask fits:

• Regular DeFi users who interact with EVM dApps on desktop and mobile.
• People who like direct control of on-chain permissions and understand gas trade-offs.

Who should look elsewhere or add tools:

• Users who want built-in token-approval management in a non-custodial mobile-first product might prefer wallets with integrated allowance managers or multisig setups. See alternatives: [/alternatives].
• If you keep large holdings cold, combine MetaMask for daily activity with a hardware wallet or multi-signature for vault-level security. See hardware best practices and backup and recovery.

FAQ

Q: Is it safe to keep crypto in a hot wallet?
A: Hot wallets are convenient but inherently riskier than cold storage. Keep only the funds you need for daily DeFi activity in MetaMask. For everything else, use cold storage or a multisig. See security best practices.

Q: How do I revoke token approvals?
A: Copy your address, use an allowance manager or on-chain explorer to list approvals, connect with MetaMask, and submit a revoke (approve 0). Follow the step-by-step above and our how-to: how to revoke token approvals.

Q: What happens if I lose my phone?
A: Losing a device doesn’t lose funds if you have your seed phrase (recovery phrase) and kept it secure. If someone gets both your phone and recovery phrase, they can drain funds — backup safely. See backup and recovery options.

Q: Can revoked approvals be undone?
A: Yes. You can approve a spender again. Revoking is simply another on-chain transaction that changes the allowance.

Conclusion & next steps

Approvals are a core part of using DeFi with MetaMask. They offer convenience, but they also expose you to smart contract risk. In my experience, periodic cleanup of approvals is a small time investment that removes a big attack surface.

Actionable next steps: disconnect unused sites in MetaMask, scan your account for approvals, and revoke any unlimited allowances you don’t actively use. If you want a guided walk-through, see revoke approvals and how to revoke token approvals.

But don’t stop there — combine this routine with good backups and hardware signing for large balances. And always double-check contract addresses before approving anything.