How to Revoke Token Approvals on Base and Arbitrum: My 10-Minute Quarterly Cleanup

The approval I almost forgot about

Last year I tried a small leverage protocol on Base. I deposited, played with it for a weekend, lost interest, and left. Six months later that protocol rebranded, changed its contract permissions, and quietly started drawing down tokens from wallets that still held unlimited approvals. I saw the post-mortem thread on a Monday morning and recognized the contract address from my own history.

My approval was still live. I revoked it over coffee for about $0.003 in gas. Nothing was lost. But that is the moment I turned approval cleanup from "something security people mention" into a calendar event. Every quarter, ten minutes, both chains.

If you need the background on what an approval actually is and why approving tokens costs gas, the ERC-20 approval fee guide covers the mechanics. This article is the cleanup side: how to find what you approved, what to kill, what to keep, and what the whole operation costs.

Why old approvals are the real wallet risk

When you swap on Uniswap, mint an NFT on a new site, or deposit into a lending protocol, you typically sign an ERC-20 approval first. That signature tells the token contract: "this other contract is allowed to spend my tokens, up to this amount." Most people click unlimited without reading it, and most front-ends default to unlimited for convenience.

Two facts make this dangerous. First, the approval lives on the token contract forever — uninstalling the app, closing the tab, or deleting your history changes nothing. Second, you are trusting not just the protocol today, but every future version of its contracts. Teams get hacked, upgrade keys get compromised, and outright rugs re-use dormant allowances as a final exit. The approval is the tool that turns a protocol hack into your tokens moving.

This is exactly the attack path described in the L2 security risks guide: most money lost on rollups is lost through app-level permissions, not bridge failures. Revoking is the cheapest insurance in crypto — literally fractions of a cent on Base and Arbitrum.

What a revoke actually costs

A revoke is just another approval transaction, this time setting the allowance to zero. It costs the same gas as any token approval:

The price gap is the whole reason to do this hygiene on rollups. On mainnet, revoking ten old approvals can cost a restaurant meal. On Base, the same cleanup rounds to zero. I also batch the session — open the checker once, make the full revoke list, then fire them back to back — so I pay attention once instead of twelve times. The gas reserve guide has the math on how long a few dollars of ETH lasts for this kind of maintenance.

How I judge what to keep

A blanket "revoke everything" pass feels safe but can break live positions. I use three categories:

• Revoke immediately: anything I do not recognize, airdrop-claim sites from last season, protocols that shut down or rebranded, and any spender labeled an unverified contract on the explorer.
• Revoke and re-approve later if needed: DEXs and NFT markets I use once a quarter. Approvals are free to recreate — a fresh approval costs a cent when I actually return to the app.
• Keep for now: contracts holding live deposits. If I have collateral in Aave, an active Uniswap V3 LP position, or funds locked in a vault, the protocol needs its allowance to function. Revoking does not withdraw the funds, but it can make normal operations fail until you approve again.

One special case is Permit2, the shared approval contract used by Uniswap and many newer apps. Revoking Permit2 is safe and wipes every approval routed through it in one move — convenient — but your next swap will ask for approvals again. I treat it like any other spender: if I am not actively trading that month, it goes.

The fake "approval checker" scams

Because "revoke approvals" is a searched phrase, phishing sites now buy ads around it. The fake versions share a pattern: they show you a scary list of "leaks," then ask you to connect and sign a transaction they label as revocation. The signature is actually a token transfer or an approval to their contract, and your wallet empties within a block.

My rules: only use a tool I have seen linked from the explorer itself (Basescan and Arbiscan both ship an approvals view) or a well-known open-source checker with a domain I typed manually. Never arrive from a DM, a reply, or a search ad. And read what the wallet popup actually says — a genuine revoke sets an allowance to zero to a spender you already approved; anything that says "transfer" or approves a fresh contract is the scam.

The same skepticism applies to "claim now" airdrop bait that leads into an approval request. The Base airdrop guide walks through how those lures are constructed.

The 10-minute routine, end to end

Quarterly reminder fires on a Sunday. I open the approval checker, connect, and review Base first — usually a few hundred approvals are shown if the tool tracks historical ones, but I only care about spenders with current allowances on tokens I hold. Unknown spender gets revoked. Old farming protocol gets revoked. Unlimited approval on an exchange router I have not touched since spring gets revoked. I keep live DeFi positions and the two routers I use weekly.

Then I flip to Arbitrum and repeat. Total transactions: maybe a dozen, usually under $0.30 all in. I verify a couple of the revokes on the explorer tabs, because seeing the zero allowance myself is worth ten seconds.

Two extra triggers sit outside the quarterly schedule: right after any week of airdrop farming, where I have approved five experimental protocols in a row, and any time a major Base or Arbitrum app makes headlines for an exploit — I pull up my approvals for that protocol before the story even finishes loading. Preventive maintenance beats reacting to a drain notification, and on these chains it costs less than the coffee I drink while doing it.