Token approvals outlive a trade

For ERC-20 tokens, an allowance can let a spender transfer tokens on an owner's behalf. The permission may remain after the immediate action finishes. Disconnecting a website from a wallet's interface does not necessarily remove an onchain allowance.

Check the permission itself

Identify the network, token contract, spender and amount. An unlimited allowance gives a different exposure from a narrowly limited one. Also consider whether the spender can be upgraded or otherwise change behaviour.

Review unused allowances through a trusted tool reached independently. A permission-revocation website can itself be impersonated. Revocation is an onchain change and does not recover assets already transferred. It also cannot secure a wallet whose private key has been exposed.

A balance that is currently empty can become exposed later if the allowance remains and new tokens arrive. This is why separating wallet uses and periodically reviewing permissions address different risks. For permissions created by a signature rather than an immediate transaction, read signed permits.

Sources

1. ERC-20: token interface and allowances
2. MASTR: Crypto Survival Guide, four original panels

Research checked 5 September 2026. Historical cases retain the date and legal status of the cited record.