Revoke Token Approvals on Ethereum: A Revocation Now Costs 0.52 Cents

If you have ever swapped a token on a decentralized exchange, deposited one in a lending pool or sent one through a bridge, an approval you forgot about long ago is very probably still live today. It allows a contract that is not yours to move your tokens out. It does not end with the swap, it does not expire after a year, and it does not lapse when the project behind it is abandoned. It ends only when you revoke it yourself.

The objection to clearing them up was the same for years: every revocation is a separate transaction, every transaction costs gas, and anyone sitting on twenty old approvals pays twenty times over. That objection no longer holds in this form. We ran the numbers on September 14, 2026, and revoking a single approval on Ethereum mainnet currently costs around half a cent.

Token Approval Explained: Why an approve Keeps Running After the Swap

A token approval, also called an allowance, is permission granted to an external contract address to take a certain quantity of a token out of your account. This is no flaw in the design. It is the mechanism without which the ERC-20 standard would not work at all.

The reason lies in how the standard is built. An ERC-20 token is its own contract with its own ledger. When you want to hand tokens to another contract, that contract cannot simply take them, it has to collect them itself. That requires two steps: first the approval through the approve function, then the actual operation, in which the contract pulls the tokens via transferFrom. You can read it up in the EIP-20 standard description, which has set out this split since 2015.

What matters is what does not happen in the second step. The standard makes no provision for the approval to expire once it has been used. It is reduced by the amount that was pulled, and if the approved amount was high enough, a remainder stays in place. That remainder is exactly the problem at issue here.

Unlimited Approval: What the uint256 Maximum Means for Your Balance

Many interfaces do not ask for an amount at all. They set the approval straight to the highest value the standard permits. That value is known as the uint256 maximum and is a 78-digit number. In practice it means unlimited, forever, covering the full size of your current and any future balance of that token.

For the operator of the interface this is convenient, because you only have to approve once and can trade afterwards without any further confirmation. For you it shifts the ceiling on the damage. An approval capped at 500 USDC can cost you 500 USDC in the worst case. An unlimited approval costs you everything held in that token at that address, at the moment the approved contract is compromised.

That moment is no theoretical one. In recent weeks we have reported repeatedly on cases in which users lost balances without ever giving away a seed phrase: through manipulated signature requests from wallet drainers as well as through tokens with a built-in freeze and clawback function. An old approval works in the same direction, only more quietly: once it is in place, it never asks you for another click.

It helps to be clear about what an approval is not. It gives nobody your private key, it grants no access to your Ether balance, and it only ever covers the one token you granted it for. Anyone holding ten tokens who has granted an unlimited approval for each of them has ten separate points of entry, not one.

Our Own Measurement: 5,910 Approvals in One Hour, 13.9 Percent of Them Unlimited

So that the scale does not remain a claim, we measured it. This analysis was carried out by cryptoticker.io itself on September 14, 2026.

The method in one sentence: through a public Ethereum node we read out every approval event for the five most used ERC-20 tokens across a contiguous window of 300 blocks and sorted them by the size of the approved amount. The window covers blocks 25,972,833 to 25,973,132, that is the period from 02:54 to 03:55 UTC on September 14, 2026, a good hour of network operation. The contracts examined were those of USDT, USDC, DAI, WETH and LINK.

In that hour there were 5,910 approval events, spread across 3,301 transactions. Of these, 820 stood at the uint256 maximum, meaning unlimited. That is 13.9 percent. A further eleven approvals sat below the maximum but above 10 to the power of 30 units, which for each of these tokens amounts to an unlimited approval. Together that gives 14.1 percent.

The distribution across the individual tokens diverged sharply. For WETH, 477 of 2,140 approvals were unlimited, a share of 22.3 percent. For USDC it was 203 of 2,475, or 8.2 percent. USDT came in at 130 of 1,181, or 11.0 percent. The smaller samples for DAI (7 of 83) and LINK (3 of 31) contribute little to the finding given their low case numbers and appear here only for the sake of completeness.

A second figure from the same measurement deserves attention because it points the other way: 1,241 of the 5,910 events were approvals set to zero, in other words revocations. One in five approval transactions in this window was therefore a clean-up. Awareness of the issue exists, and a measurable share of users acts on it.

What we could not establish with this method belongs here just as much. We did not assess the receiving addresses for whether a reputable protocol or a fraudulent contract sits behind them, since an unlimited approval granted to an established exchange interface is a different matter from one granted to an unknown address. We also measured only approvals newly granted within this window, leaving out the existing stock of open approvals that has built up over years and cannot be read out with this type of query. Finally, the figures exclude all approvals on layer-2 networks such as Arbitrum, Base or Optimism, as well as signature-based approvals following the Permit2 pattern, which generate no approval event at all. The true number of open approvals therefore lies above what is shown here.

Gas at 0.049 Gwei: What Revoking on Ethereum Really Costs Today

The second half of the measurement concerns the price. Here too the figures are queried values rather than an estimate. For six reference dates we read out ten blocks each, spaced 50 blocks apart, and took the median of the base fee.

On September 14, 2026, this median stands at 0.0492 Gwei, with a range of 0.0389 to 0.0540 Gwei across the ten samples. Seven days ago it stood at 0.0493 Gwei, 30 days ago at 0.0616 Gwei. Going back three months produces a different picture: on June 15, 2026, the median stood at 0.2097 Gwei, on March 17 at 0.1155 Gwei, and on September 12, 2025, at 0.1539 Gwei. Today's level is therefore barely a quarter of the value from three months ago and around a third of the value from a year ago.

That leaves the question of how much gas a revocation actually consumes. We measured this as well instead of taking it from a rule of thumb: out of the transactions in the measurement window we filtered 23 that produced exactly one event, meaning pure approval operations with nothing else attached. Their gas consumption ranged from 24,080 to 55,906 units, with a median of 48,837.

From this the calculation follows. 48,837 gas units at 0.0492 Gwei come to 0.0000024 Ether. At a price of 2,170.21 euros per Ether, retrieved on September 14, 2026, from Kraken, that equals 0.52 cents. Across the measured gas range the price moves between 0.26 and 0.60 cents. Clearing up ten approvals therefore costs around five cents. For comparison: on June 15 the same revocation would have cost 2.22 cents, which supports the point rather than undermining it. Even back then the operation was not expensive.

This is where the actual finding of the analysis lies. Cost does not work as a justification for leaving old approvals in place, and it has not worked as one for some time. Even so, 13.9 percent of all newly granted approvals still sit at unlimited. The transaction fee is not what stands in the way. What is missing is the habit of clearing up once the swap is done.

Checking Token Approvals: How to See What Is Open in a Few Minutes

Getting started is unspectacular. You need your public address, no seed phrase and no installation.

The quickest route is an approval checker. The best known one is Revoke.cash, which was reachable when we called it up on September 14, 2026, and which breaks down the open approvals of an address by token and contract address. Etherscan also runs a tool of its own under the name Token Approval Checker that produces the same list; the page blocks automated requests, while in a normal browser it is readily accessible.

You can start by simply typing in the address and looking at the list without connecting a wallet. For a plain look-up that is entirely sufficient, and it is the safer route: an interface you are using for the first time does not need immediate access to your account. You only have to connect once you actually want to revoke, because that requires a transaction and therefore a signature.

How to Spot a Risky Approval

Three characteristics tell you most. If the amount column points to an unlimited quantity, the approval is open regardless of your current balance. If the grant date goes back months or years and you cannot remember the protocol, there is no reason to let it keep running. And if the receiving address carries no known contract name, only a bare hex address, it deserves particular attention.

One qualification belongs here: the fact that an approval goes to a well known, heavily used protocol does not make it harmless. The large losses of recent years arose predominantly at established contracts that only revealed a gap later on.

Revoking Approvals: The Process Step by Step

A revocation is technically the same thing as an approval, only with the amount set to zero. You call the same approve function and set the permitted quantity to nothing. After that the contract can pull nothing more.

In practice it runs like this: you open the approval checker, connect your wallet, select the approval you want gone from the list, and confirm the transaction. Pay attention to what your wallet shows you before you sign. It has to be an approve on the token contract you are currently clearing up, and the amount has to be zero. If your wallet shows you a transfer of your balance instead, or a signature with no recognizable function, abort.

Every approval needs its own transaction, and that holds even when the interface offers several at once. So reckon with the measured half a cent per operation, not with a flat price for the whole list. Anyone with a great many old approvals can work by the size of the balance and start with the tokens that actually hold something. An unlimited approval on a token of which you hold zero units is untidy, yet at that moment it has no effect. It becomes dangerous only once something arrives at the address again.

Limited Approval Instead of Unlimited: What a Fixed Amount Really Achieves

The more effective step comes before the revocation, namely at the moment of granting. Most wallets let you overwrite the proposed unlimited amount when confirming and enter exactly the quantity this particular operation is about.

The price for that is convenience. If you want to trade again next week, you have to approve again, and that costs another transaction. At the gas price measured today, this price is five tenths of a cent per operation. Anyone trading regularly therefore pays a few euros a year for the assurance that no open approval is left behind.

Against that stands the benefit. A limited approval caps the possible damage at the amount entered, and it effectively expires by itself because it is used up during the operation. Precisely this property makes the difference between an annoying and an existential loss when a contract is compromised years later.

The Special Case of Permit2 and Signatures

A newer pattern works with a signature in place of a transaction. Under the name Permit or Permit2 you grant permission by signing a message that the contract later submits itself. This saves you the gas cost of the approval and therefore also generates no approval event on the blockchain, which is why these permissions are missing from our measurement.

For you that means two things. A signature request can have the same effect as an approval, even though it looks more harmless and costs nothing. And a permission granted by signature will show up in some approval checkers only if the tool explicitly supports Permit2. Check that before you take an empty list for a clean list.

What Revoking Does Not Protect: Seed Phrase, Signatures and Phishing

Tidy approvals limit the damage. They are no shield. They help you against exactly one attack pattern: a contract you once granted access to that later uses this access against you.

They do not help you if your seed phrase goes missing, because whoever holds the key needs no approval. They do not help you against a freshly signed transaction on a spoofed page, because in that moment you are granting a new permission rather than using an old one. And they do not help you with tokens whose contract brings its own blocking or clawback function, as many regulated and tokenized assets have built in.

Revoking therefore belongs alongside the other habits rather than in their place: separate addresses for trading and custody, a hardware wallet for the holdings that stay put, and the habit of reading every signature request before you confirm it.

Separate Addresses: Why an Approval Only Costs What the Account Holds

There is a way to defuse the topic structurally, and it manages without any tool at all. An approval can only ever reach what sits at the address it applies to. Anyone who separates their holdings limits the damage regardless of how clean their approval list is.

In practice that means one address on which you trade and use contracts, and a second one on which the holdings you do not touch are kept. The second address connects to no decentralized interface and therefore never grants an approval. If you also manage it through a separate wallet instead of the same software installation, you separate the risk that a compromised interface reaches both accounts at once.

This split has a side effect you should be aware of: moving holdings between your own addresses counts as a transfer for tax purposes rather than a sale. You should still document it cleanly, because your exchange has been reporting these movements to the tax authorities since the beginning of 2026, and an unexplained outgoing transfer raises questions later on. What exactly gets transmitted is something we have broken down in our overview of the crypto reporting obligation.

Revoking Token Approvals: What to Take Away

1. Check today what is open. Enter your address into an approval checker without connecting the wallet, and get yourself a list. Anyone who finds an unlimited approval to a protocol they have not used for a year has already spent the afternoon usefully. For the holdings that are meant to stay put afterwards, our hardware wallet comparison is worth a look.
2. Clear up in the order of your balances. Begin with the tokens you actually hold something in, and work your way down. At a measured price of around half a cent per revocation, the list is a question of half an hour of your time rather than of cost. Which wallet shows you the approvals in plain language when you confirm them is set out in our software wallet comparison.
3. Change the habit at your next approval. Overwrite the unlimited proposal and enter the amount the operation is about. That costs you one more transaction on your next trade and in return caps every future loss at a sum you have set yourself. Anyone who wants to keep a clean overview of their holdings and movements will find the right tools in our portfolio tracker comparison.

(As of September 14, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)