Revoke token authorization on Ethereum: Now it only costs 0.52 cents

Detailed explanation of token authorization: Why authorization is still valid after redemption

If you have exchanged tokens on a decentralized exchange, deposited funds into a loan pool, or transferred assets through a bridge agreement, then an authorization you ignored years ago is likely to still be valid today. It allows contracts not owned by you to transfer tokens from your account. This authorization will not terminate with the end of the redemption, will not expire after one year, and will not expire due to the abandonment of the project behind it. It only ends when you revoke it.

Over the years, resistance to clearing these authorizations has remained constant: each revocation is a separate transaction, each transaction requires a Gas fee, and users holding twenty old authorizations pay twenty times the Gas fee. However, this view no longer holds true. We calculated on September 14, 2026 that the current Gas cost of revoking a single authorization on the Ethereum main network is about half a cent.

Token authorization (also known as Allowance) refers to granting an external contract address the right to withdraw a specific number of tokens from your account. This is not a design flaw, but the basic mechanism for the ERC-20 standard to work.

The reason lies in the way standards are built. The ERC-20 token is a smart contract with a separate ledger. When you want to hand over tokens to another contract, the contract cannot take them directly and must withdraw them yourself. This requires two steps: first authorization is performed through the approve function, and then in actual operation, the contract pulls the replacement coin through the transferFrom function. You can learn about this splitting mechanism in the EIP-20 standard description, which has been the case since 2015.

The key lies in what did not happen in the second step. The standard does not stipulate that authorization will expire after use. The authorization amount will be deducted by the pulled amount. If the initial authorization amount is high enough, the remaining portion will continue to exist. This is the core of the problem here.

Unlimited authorization: What does the uint256 maximum mean to your balance

Many interfaces do not ask for a specific amount at all, but instead directly set authorization to the maximum allowed by the standard. This value is called the uint256 maximum and is a 78-bit number. In practice, this means a permanent unlimited amount, covering your entire current and future balance of the token.

This is convenient for interface operators because you only need to approve once and then trade without further confirmation. But for users, this pushes up the upper limit of damage. A license limit of 500 USDC will lose 500 USDC in the worst case; an unlimited license means that once the license contract is breached, you will lose all the tokens held at that address.

This situation is not a theoretical assumption. In recent weeks, we have reported multiple cases where users have never leaked a mnemonic phrase but have lost their balance: from manipulative signature requests from wallet cleaners to tokens with built-in freezing and rollback features. The old authorization works in the same way, only more stealthy: Once set up, it never asks you to click confirm again.

Clarify authorization is not as important as anything. It does not give you anyone's private key, does not grant access to your ETH balance, and only covers the single token you grant it. Anyone who holds ten tokens and grants unlimited authorizations for each individually has ten separate entry points, not one.

Authorization is like a spare key that you have issued but never taken back.

Our measurement: There were 5,910 authorizations in one hour, of which 13.9% were unlimited

In order to keep the scale beyond the claimed level, we conducted actual measurements. This analysis was performed by cryptoticker.io on September 14, 2026.

Method description: Through the public Ethereum node, we read all authorization events of the five most frequently used ERC-20 tokens in a time window of 300 consecutive blocks, and sorted them by authorization amount. This window covers blocks 25,972,833 to 25,973,132, which is 02:54 to 03:55 UTC on September 14, 2026, for approximately one hour of network operation. Contracts reviewed include USDT, USDC, DAI, WETH and LINK.

During that hour, 5,910 authorization events occurred, spread across 3,301 transactions. Among them, 820 reached the maximum value of uint256, that is, there is no limit. The proportion is 13.9%. Another 11 authorizations were below the maximum but above 10 to the 30th power, which also amounts to no limit for each token. The total proportion is 14.1%.

There are significant differences in distribution among tokens. For WETH, 477 of the 2,140 authorizations are unlimited, accounting for 22.3%. For USDC, 203 of the 2,475 are, accounting for 8.2%. The USDT is 130 out of 1,181, accounting for 11.0%. The DAI (7 of 83) and LINK (3 of 31) samples are small, and given the small number of cases and limited contribution to conclusions, they are listed here for completeness only.

Another data from the same measurement is noteworthy because it points in the opposite direction: 1,241 of the 5,910 events were events that set authorization to zero, or revocation. Therefore, during this window period, one in every five authorized transactions is a cleanup operation. This shows that users are aware of the problem and that a measurable group of users is taking action.

What cannot be determined using this method is also explained here. We did not assess whether the receiving address was a reputable agreement or a fraudulent contract, because granting unlimited authorization to a well-known exchange interface is two different things than granting unlimited authorization to an unknown address. We also only measured newly granted authorizations during this window period, excluding the existing stock of open authorizations that has accumulated over the years, which cannot be read through such queries. Finally, this data does not include all authorizations on Layer-2 networks such as Arbitrum, Base, or Optimism, nor signature-based authorizations that follow the Permit2 model, which do not generate authorization events at all. As a result, the actual total open authorizations is higher than the numbers shown here.

Gas fee is 0.049 Gwei: The true cost of revoking authorization on Ethereum today

On September 14, 2026, the median was 0.0492 Gwei, and the range for ten samples was 0.0389 to 0.0540 Gwei. It was 0.0493 Gwei seven days ago and 0.0616 Gwei 30 days ago. Looking back at the situation three months ago, a different picture appears: the median on June 15, 2026 was 0.2097 Gwei, on March 17, it was 0.1155 Gwei, and on September 12, 2025, it was 0.1539 Gwei. As a result, today's level is only about a quarter of what it was worth three months ago and about a third of what it was worth a year ago.

This begs the question: How much Gas does revocation actually consume? Instead of using a rule of thumb, we conducted measurements: we filtered out 23 transactions that generated exactly one event from the transactions in the measurement window, which is purely authorization operations, with no additional content. Their Gas consumption ranged from 24,080 to 55,906 units, with a median of 48,837.

This results in the calculation. 48,837 Gas units multiplied by 0.0492 Gwei equals 0.000024 Ether. Based on the price of 2,170.21 euros/ETH obtained from Kraken on September 14, 2026, this is equivalent to 0.52 cents. Within the measured Gas range, prices fluctuate between 0.26 and 0.60 cents. Cleaning up ten authorizations costs about five cents. For comparison: On June 15, the same undo operation cost 2.22 cents, which actually supports our view rather than weakens it. Even then, operation was not expensive.

This is the actual finding of the analysis. Cost cannot be a reason to retain the old authorization, and it will no longer be so reasonable for some time. Despite this, 13.9% of new authorizations remain unlimited. What hinders people is not transaction fees, but the lack of habit of cleaning up after redemption is completed.

Checking token authorizations: How to check open status in minutes

Getting started is not eye-catching. You only need to disclose the address, no mnemonic phrases, and no software installation.

The fastest way is to use an authorization checker. The most famous one is Revoke.cash, which can be accessed normally when we called it on September 14, 2026. It can decompose the open authorization of addresses by token and contract addresses. Etherscan also has its own tool, called Token Approval Checker, that generates the same list; the page blocks automated requests but is easy to access in a normal browser.

You can simply enter the address and view the list without connecting to your wallet. For simple queries, this is completely sufficient and safer: the first interface you use does not require immediate access to your account. You only need a connection if you really want to undo, because it requires a transaction and a signature.

Three characteristics of how to identify high-risk authorizations

are the most telling. If the amount column points to unlimited quantities, authorization is open regardless of the current balance. If the grant date dates back months or years and you can't remember the agreement, there is no reason for it to continue working. If the receiving address does not have a known contract name and only has a bare hexadecimal address, special attention should be paid.

There is a qualification here: a protocol authorized for well-known, high-frequency use does not mean it is harmless. Major losses in recent years have mainly occurred on long-established contracts that later revealed loopholes.

Revocation of authorization: step-by-step operation process

Technically, revocation is the same as authorization, except that the amount is set to zero. You call the same approve function and set the allowed number to none. After that, the contract will no longer be able to withdraw any tokens.

The actual operation is as follows: Open the authorization checker, connect to your wallet, select the authorization to delete from the list, and confirm the transaction. Pay attention to what your wallet displays before signing. It must be an approval operation for the token contract you are currently clearing and the amount must be zero. If your wallet displays a balance transfer or a signature with an unrecognized function, please abort immediately.

Each authorization requires a separate transaction, even if the interface provides multiple options simultaneously. Therefore, please estimate costs at a measured half-cent per operation, rather than a fixed price for the entire list. People with a large number of old authorizations can operate based on the size of the balance, starting with the tokens actually holding the assets. For tokens that you don't hold zero units, unlimited authorization, while messy, has no impact at that moment. The asset only becomes dangerous when it enters the address again.

Fixed amounts limit potential damage to exactly the amount you need to operate.

Limited authorization rather than unlimited authorization: What can a fixed amount achieve

A more effective step occurs before revocation, at the moment of grant. Most wallets allow you to override the proposed unlimited amount upon confirmation and enter the exact amount for this particular operation.

The price paid for this is convenience. If you want to trade again next week, you have to reauthorize, which requires another trade. At today's measured Gas prices, each operation costs one-fifth of a cent. Therefore, frequent traders pay a few euros per year to ensure that no open authorizations are left.

In contrast, the benefit is that a limited authorization limits potential damage to the amount entered, and it effectively expires automatically because it is exhausted during the operation. It is this characteristic that makes the difference between annoying losses and survival losses when the contract is breached many years later.

Permit2 and special cases of signatures

A newer model uses signatures instead of transactions. Under the Permit or Permission2 name, you grant permissions by signing a message, and the contract then submits itself. This saves the Gas cost of authorization, so there are no authorization events on the blockchain, which is why these permissions are missing in our measurements.

This means two things. First, a signature request may have the same effect as an authorization, although it may seem more harmless and cost-free. Second, permissions granted by signature will only appear in some authorization checkers if the tool explicitly supports Permit2. Check this before treating empty lists as clean lists.

What does revocation not protect: mnemonic phrases, signatures, and phishing

Neat authorizations can limit damage, but they are not shields. They help with only one attack pattern: the contract you once granted access later uses it against you.

If your mnemonic phrases are missing, they are not helpful because the person holding the key does not require authorization. If you sign new transactions on a new fake page, they won't help either, because at that moment you are granting new permissions rather than using old permissions. They also don't help with tokens with their own blocking or rolling back capabilities (which are built into many regulated and tokenized assets).

Therefore, revocation should be juxtaposed with, rather than replacing, other habits: using separate addresses for transactions and custody, storing unused positions in hardware wallets, and making the habit of reading every signature request before confirming it.

Separated Address: Why authorization only spends the amount held in the account

There is a structured way to resolve this topic and requires no tools at all. Authorization can only touch assets present at the applicable address. Anyone who separates their positions, no matter how tidy their authorization list is, can limit the damage.

In practice, this means one address for trading and using contracts, and a second address for holding untapped positions. The second address does not connect to any decentralized interfaces, so authorization is never granted. If you also manage it through a separate wallet rather than using the same software installation, you isolate the risk of a compromised interface accessing two accounts simultaneously.

This separation has a side effect you should be aware of: Moving positions between your own addresses counts as a transfer rather than a sale for tax purposes. You should still document it clearly because your exchange has been reporting these movements to tax authorities since early 2026, and unexplained outflow transfers can raise questions in the future. We have broken down in detail what was transmitted in the overview of encrypted reporting obligations.

Revoke token authorization: summary of key points

Check open status today.

Without connecting to your wallet, enter your address into the authorization checker to get the list. Anyone who has discovered unlimited authorization for a protocol that hasn't been used for a year has had a valuable afternoon. For positions that are designed to remain unused later, our hardware wallet is worth a look.

Clean up in order of balance.

Start with the token you actually hold in the asset and gradually go down. At a measured cost of about half a penny per revocation, it is a task that takes half an hour rather than costs. Which wallet displays authorization in plain language during confirmation? See our software wallet comparison for details.

Change your habits the next time you authorize it.

Overwrite unlimited proposals and enter the amount required for the operation. This will add a transaction cost the next time you trade, but in return it limits each future loss to the amount you set. Anyone who wants to maintain a clear overview of positions and movements can find the right tool in our Portfolio Tracker Comparisons.

(As of September 14, 2026. This article does not constitute investment advice. Price and fee structures are subject to change; please check terms with your provider before purchasing.)