After trading on a DEX, disconnecting the website may leave token approvals in place. Disconnecting and revoking an approval do different jobs. It is important to understand what a wallet screen authorizes before clicking.
Connections, approvals and signatures
- Wallet connection: Lets a website see a public address and send requests to the wallet. A connection alone does not grant permission to take every token.
- Token approval: Allows a specified address, called the spender, to use your tokens up to a limit. The spender can be a smart contract or an ordinary account address. ERC-20 allowances are a common example.
- Signature: Cryptographic proof of agreeing to a message or request. It may verify a login, but mechanisms such as Permit can also affect permission to use assets.
A signature that costs no gas is not automatically safe. Check the data to be signed and the address of the service requesting it.
Why disconnecting does not necessarily remove approvals
A website connection is managed through the wallet's connection settings, while a token approval can be recorded in a blockchain contract. Existing approvals can therefore remain valid after disconnection.
Revocation is a separate action that reduces or removes the permission. Ordinary on-chain revocations require a network fee. Some NFT approvals apply to an entire collection, so inspect their scope carefully.
Reviewing permissions
- Find the approval-checking procedure in your wallet's official help.
- Match the network, token and address holding the permission—the spender.
- Review services you no longer use and unnecessarily large allowance limits.
- Confirm in a block explorer that the revocation transaction succeeded.
Never enter a recovery phrase into an unfamiliar link that claims to perform a “security check”. If a private key or recovery phrase has already leaked, revoking approvals alone is not enough. Compromised keys and exposed approvals are different problems.
Comments 0
Sign in with Google · Share a respectful, relevant opinion.