How to revoke token approvals in Rabby
Open Rabby's approvals list, find the contract or asset you want to cut off, select it and choose revoke, then confirm the transaction. Each revoke is an on-chain transaction that costs gas. Disconnecting a dapp does not cancel an approval; only revoking does.
Quick steps
- Open approvals. Open the approvals list in Rabby from the home screen or menu and select the address to review.
- Sort by risk. Look first at contracts Rabby flags, then unlimited amounts, NFT approvals for all and contracts you do not recognise.
- Select approvals. Select the approvals you no longer need.
- Revoke and confirm. Choose revoke, read the preview and confirm each on-chain transaction, keeping some gas on that chain.
- Disconnect old sites. Also remove dapps you no longer use from Rabby's connected sites.
- Recheck. Confirm the revoked approvals no longer appear in the list.
When you use a dapp, you often give a smart contract permission to move your tokens or NFTs. That permission, called an approval, stays active after you leave the site, and often has no limit. If the contract is later exploited, or if you approved a drainer by mistake, it can take the approved assets without asking again. Revoking approvals you no longer need closes that door.
Types of permission
| Permission | What it allows | Risk |
|---|---|---|
| Token approval (approve) | A contract may spend up to a set amount of one token | High if the amount is unlimited |
| NFT approval for all (setApprovalForAll) | A contract may move every NFT in a collection | High; a favourite drainer trick |
| Permit and Permit2 signatures | An off-chain signature that grants an allowance without a separate approval transaction | High; looks like a harmless signature |
| Site connection | A dapp can see your address and ask for signatures | Low; cannot move funds by itself |
Rabby's approvals page covers token, NFT and Permit2 approvals. Since August 2026 it also detects EIP-7702 delegations, where an address has delegated its code to a smart contract, and lets you revoke them (Rabby source code, 2026). Paste a suspicious approval into our approval risk explainer to see what it grants.
Disconnecting is not revoking
Removing a site from Rabby's connected sites only stops it from seeing your address and requesting signatures. Token approvals live on the blockchain and stay active until you revoke them with a transaction (CryptoSlate, 2026). Do both when you stop using a dapp you do not trust.
How to revoke in Rabby
- Open the approvals list. In the extension, open the approvals option from the home screen or menu. It may open in a full browser tab. The mobile app also offers approval management.
- Pick the address and review. Rabby lists each approval with the contract, the dapp it belongs to, the token, the approved amount and when you last interacted (Bytwork, 2026). You can usually view by contract or by asset.
- Start with the risky ones. Rabby marks contracts with known security problems so you can revoke them urgently. Next, look at unlimited amounts, NFT approvals for all, and contracts you do not recognise or have not used in months.
- Select and revoke. Select one or more approvals and choose revoke. Rabby prepares the revoke transactions.
- Confirm and pay gas. Read the preview and confirm. Each revoke is an on-chain transaction on that chain, so you need a little of the gas token there (or Rabby's Gas Account).
- Check the list again. Once confirmed, the approval disappears from the list.
Rabby's exact button names change between versions. If you do not see a step as described, look for the approvals or security section of the menu.
Why this matters: the 2022 Rabby Swap exploit
On October 11, 2022, about a month after Rabby Swap launched, an attacker exploited a bug in its router contract, which had been audited by PeckShield, and took tokens from users who had approved it. Private keys were not affected. Rabby disclosed the attack and urged users to revoke approvals to the affected contract. Estimates of the losses vary, from about 114 ETH and 179 BNB (The Block, 2022) to roughly 200,000 dollars (Neptune Mutual and Revoke.cash, as cited by CryptoSlate). The lesson applies to every wallet and dapp: old, unlimited approvals are a standing risk. Details are in Rabby security history.
When to review approvals
- After you hear that a dapp or bridge you used was hacked.
- After you signed something you did not fully understand.
- After moving from another wallet, because approvals stay with the address. See import MetaMask to Rabby.
- Every few months as routine.
Keeping revoke costs down
Revoking on Ethereum mainnet can cost more than the approval is worth for tiny balances, while revoking on most layer 2 networks costs little. Focus mainnet revokes on tokens you still hold in meaningful amounts and on approvals for all of a valuable NFT collection. An approval for a token you no longer hold is less urgent, but it becomes dangerous again if you receive that token later. Our gas cost estimator helps you judge the cost first.
If funds are already being drained
Revoking stops future spending by that contract but cannot recover what is gone. If you think your seed phrase or private key leaked, revoking is not enough, because the attacker can sign anything. Create a new wallet with a new seed phrase on a clean device and move the remaining assets there quickly. Be wary of anyone who contacts you offering recovery services; they are almost always scammers. See fake Rabby scams.
Prevent risky approvals in the first place
Rabby's pre-sign screen flags unlimited approvals and unknown contracts, and shows what a transaction will change. Where a dapp lets you, approve only the amount you need for that trade. See transaction simulation.
Frequently asked questions
Does revoking an approval cost money?
Yes. Each revoke is an on-chain transaction, so you pay network gas on that chain. Rabby does not add a fee for revoking that we could find.
Is disconnecting a site the same as revoking?
No. Disconnecting stops a site from seeing your address. The token approval stays on-chain until you revoke it.
Can revoking get my stolen tokens back?
No. It only stops that contract from taking more. If your seed phrase leaked, move remaining funds to a new wallet.
Which approvals should I revoke first?
Anything Rabby flags as risky, unlimited approvals, NFT approvals for all, and contracts you do not recognise or no longer use.
Will revoking break the dapp?
The dapp will ask for approval again the next time you use it. That is normal and safe if you trust it.