Wallet safety

How to revoke token approvals on Base

An approval is a permission you signed once and forgot. Most wallets show it for a second and never again, while the contract keeps the right to move that token until you take it back. Revoking is a small, boring transaction — and the cheapest security habit in crypto.

Updated 11 November 2026.

1. Understand what you actually signed

An ERC-20 approval is not a payment. It is a standing allowance: the spender contract may move up to that amount of that token from your wallet, at any time, without asking again. Swapping on a DEX usually sets a large or unlimited allowance so the next trade is cheaper. That is convenient while the contract is honest, and expensive if it is not.

Two details decide the risk: which spender holds the allowance, and whether the amount is unlimited. A revoked approval is simply the same call with the amount set to zero.

2. List approvals per chain, not per app

Approvals live on the chain where you signed them. A Base approval does nothing on Ethereum and does not appear in an Ethereum-only view. Use a revoker that lets you switch networks — the BaseScan Token Approvals page for Base, or a tool such as revoke.cash with the network selector set to Base — and connect a read-only view first. Never enter a seed phrase into any of them; a wallet connection is enough.

3. Rank by what can actually be taken

Sort by value at risk, not by date. The dangerous rows are unlimited allowances to contracts you no longer use, and allowances to contracts you cannot identify. An approval to a well-known router you still trade through is normal. An approval from a token you were airdropped, to a contract deployed last week, is not.

4. Revoke, confirm, and re-check

Set the allowance to zero and confirm the transaction in your wallet. On Base the fee is typically a few cents, but the wallet will quote it before you sign — if the quoted fee looks large, stop and check that you are on Base and not on a congested chain. When it confirms, reload the list and verify the row is gone. A revocation that never confirmed changed nothing.

5. Make the next approval smaller

When a wallet offers an editable allowance, set the amount you are about to trade instead of unlimited. It costs one extra approval per trade and removes the standing risk entirely. If a site insists on unlimited and you do not trust it enough for that, that is the answer about whether to use the site.

What can go wrong

• Revoking on the wrong chain — An approval list opened on Ethereum shows nothing about Base. Check the network badge before you conclude you are clean.
• Signing a 'revoke' from a pop-up — Revocation is a transaction you start in your wallet. A website asking you to sign a message to 'cancel approvals' is not revoking anything.
• Assuming a burn address is a revocation — Sending tokens away does not remove the allowance. The spender can still move the token balance you keep.

What this does not tell you

Revoking removes a permission; it does not undo a transfer that already happened, and it cannot tell you whether a contract is malicious in some other way. It also cannot protect a wallet whose key is already compromised — if you did not create a transaction and it appeared anyway, revoking is not the fix; moving the remaining funds to a new wallet is.

Questions