What you are approving
MetaMask describes a token approval as permission for an app to access and move a specific type of token from your wallet (MetaMask Help Center). It is part of the token standard itself: ERC-20 lets an account approve how much of a token a third party may spend (ethereum.org). A bridge or an on-chain exchange that moves a token from your wallet needs that permission before it can.
Why unlimited approvals are the risk
Apps often ask for permission to spend an unlimited number of tokens, so that you only have to approve once. The catch, as ethereum.org puts it, is that an app with unlimited access can spend all of those tokens even after you have withdrawn your funds from it — and if that access falls into malicious hands, the funds can be taken with no recovery option (ethereum.org). MetaMask is blunter still: requesting essentially unlimited amounts of tokens is how many malicious sites steal from users (MetaMask Help Center).
Two things make this easy to forget. Contract permissions have no expiry date, and disconnecting your wallet from a site does not revoke what you approved there — that takes a separate step (ethereum.org).
How to check and revoke
On Ethereum, Etherscan’s token approval checker lists the contracts allowed to spend your tokens, shows the amount at risk if those contracts were compromised, and lets you revoke approvals after connecting your wallet. Its own description of what revoking does is plain: it prevents those contracts or addresses from spending your assets (Etherscan). ethereum.org names further tools, some covering several networks, and describes the same sequence for all of them: connect the wallet, find the approval you want to end, click revoke and confirm the transaction your wallet then proposes. Revoking is itself a transaction, so you pay the network fee for it (ethereum.org). In MetaMask, existing approvals can also be reviewed and revoked from the spending caps view in MetaMask Portfolio (MetaMask Help Center).
Reach these tools from their official pages or from ethereum.org’s own list rather than from a link someone sent you, since revoking means connecting the very wallet you are trying to protect.
Before the next approval
MetaMask lets you set a custom spending cap when an app asks for access, so you can approve the amount you actually intend to move instead of the amount the app proposes (MetaMask Help Center). ethereum.org’s own recommendation goes further: never allow unlimited access, and revoke allowances regularly (ethereum.org).
Questions
What is a token approval?
A permission for an app's smart contract to access and move a specific token from your wallet, up to an amount you allow. Token standards such as ERC-20 build it in, and apps ask for it before they can move a token on your behalf.
How do I revoke a token approval in MetaMask?
MetaMask points users to the spending caps view in MetaMask Portfolio, where existing approvals can be reviewed and unwanted ones revoked. Revoking is a transaction of its own, so it needs the network's fee like any other.
How do I check token approvals on BNB Smart Chain?
With a tool that covers BNB Smart Chain and lets you connect the wallet and list its approvals. We could not open BscScan's own approval checker to confirm how it works; ethereum.org lists revoke tools that work across several networks, so check that the one you choose names BNB Smart Chain.
Sources
- MetaMask Help Center — what is a token approval? · checked 2026-09-14
- ethereum.org — how to revoke smart contract access to your crypto funds · checked 2026-09-14
- Etherscan — token approval checker · checked 2026-09-14
- ethereum.org — the ERC-20 token standard · checked 2026-09-13