Does revoking a token approval cost money?

This tool charges no service fee. The only cost is the standard Solana network fee, a fraction of a cent, paid when you sign the transaction. Multiple approvals are batched into as few transactions as your wallet supports to keep even that to a minimum.

How do token approvals get exploited?

A malicious site can slip an Approve instruction into a transaction dressed up as a mint, claim, or connect, naming the attacker as delegate for a token. Once approved, the attacker can drain that token from your account later, at a time of their choosing, with no further prompt to you. Revoking the delegate closes that window. This is why reviewing and clearing approvals after interacting with an unknown site is a core wallet-hygiene step.

Solana wallet security · the revoke.cash for Solana

Revoke Solana token approvals

Every time you approve a dApp, you set a delegate on one of your token accounts — an address allowed to move that token on your behalf. Old and forgotten approvals are a standing risk, and a malicious one can drain a token long after you left the site. Connect your wallet to see every active approval, then revoke the ones you don’t recognise in a single signature. Free, non-custodial, and nothing moves until you sign.

Scan every token account for an active delegate in seconds
See the spender address and how much it can move
Spot unlimited approvals that cover your whole balance
Revoke risky or stale approvals in one batched signature
Covers both SPL Token and Token-2022 accounts
No service fee — only the tiny network cost to sign

Non-custodial. Your private keys never leave your wallet.
You approve everything. Scanning only reads your accounts; nothing changes until you sign.
No tokens moved. Revoking clears a delegate — it never transfers or burns anything.
Always free. No service fee, ever — just the network cost to sign.

What a token approval is, and why it matters on Solana

A token approval on Solana is a delegate set on one of your token accounts. When a dApp asks you to approve, you name another address — usually a program — as the delegate for that specific token, and grant it the right to move up to an approved amount without asking you to sign again. This is what lets a DEX pull tokens for a swap, a lending market draw collateral, or a subscription charge you on schedule. The approval is convenient by design: it trades a future signature for standing access.

Each token account holds one delegate and one approved amount at a time. The approval stays in place until you revoke it or a new approval replaces it. That means an address you approved months ago for a site you no longer use can still hold the right to move that token today. Reviewing and clearing those standing approvals is one of the simplest, highest-leverage things you can do for wallet safety.

Solana approvals vs Ethereum allowances: the key difference

On Ethereum, an ERC-20 allowance is granted per spender and is commonly set to an unlimited amount that persists indefinitely, which is why revoke tools became essential there. Solana works differently. Instead of open-ended allowances, a token account carries a single delegate and a specific delegated amount, and approving a new delegate replaces the previous one. There is no separate stack of allowances per token to comb through — there is at most one live delegate per account.

The catch. An approval can still be set to your entire balance, which is effectively unlimited for that token until you spend or move it. A drainer will request exactly that. So while Solana’s model is tidier, a single malicious approval is just as dangerous, and revoking it is just as important.

How token approvals get exploited — and how to stay safe

The attack is simple. A malicious site presents a transaction dressed up as a mint, a claim, a raffle, or a routine wallet connect, and tucks an Approve instruction inside it that names the attacker as delegate for one of your tokens. You sign, expecting the mint. Nothing obvious happens. Then, hours or weeks later, the attacker uses that standing delegate to transfer the token out of your account — no new prompt, no second chance to say no. Revoking the delegate is what closes that window.

Read before you sign

Check what a transaction actually does in your wallet’s preview. Be wary when a simple mint or claim asks to approve or delegate a token you hold.

Revoke after risky sites

After using an unknown dApp, airdrop claim, or anything that felt off, scan and clear any delegate it left behind. It takes one signature and costs nothing here.

Protect the key itself

Revoking removes a delegate, not access to a leaked seed phrase. Never enter your seed on a website, and use a hardware wallet for anything of size.

How to check and revoke token approvals on Solana

Revoking sends a Revoke instruction to the SPL Token program for a given token account. It clears that account’s current delegate and resets the delegated amount to zero, so the previously approved spender can no longer move your tokens. The tokens themselves stay exactly where they are — nothing is transferred, sold, or burned. The steps this tool follows, and the order any manual cleanup should take:

Read every token account in the wallet, across both the SPL Token and Token-2022 programs.
Keep only the accounts that have an active delegate with a non-zero approved amount.
Show the token, the delegate (spender) address, the approved amount, and whether it covers your whole balance.
Build a Revoke instruction for each, simulate the batch, and let your wallet sign them together.

Because Revoke is a tiny instruction, many fit in one transaction, so even a wallet with a long history of approvals usually clears in one or two signatures.

Revoking approvals in Phantom and Solflare

Phantom and Solflare both let you disconnect apps from their settings, but disconnecting a site is not the same as revoking a token approval. Disconnecting stops a site from prompting your wallet; it does not remove a delegate that was already granted. A delegate lives on-chain on the token account and persists whether or not the app is still connected. To actually clear it you need to send the Revoke instruction, which is what this tool does for every delegated account at once.

So the safe routine is two steps: in your wallet’s connected-apps list, disconnect sites you no longer use; and here, scan and revoke any delegate those or other sites left behind. The first stops future prompts, the second removes standing access already granted.

Is it safe to revoke, and what does it cost?

Revoking is one of the safest actions you can take on-chain. It only ever removes a delegate; it cannot move, sell, or burn a token, and it does nothing to an account that has no delegate in the first place. If you still use the dApp that set an approval, it will simply ask you to approve again the next time you interact with it — no harm done. Connecting your wallet to scan is read-only, and nothing changes until you review the list and sign.

This tool takes no service fee. The only cost is the standard Solana network fee, a fraction of a cent, paid when you sign. Multiple approvals are batched into as few transactions as your wallet supports, so you keep even that to a minimum. Security this basic should be free, and here it is.

What to do if your wallet was drained

If tokens are leaving your wallet and you suspect an approval, revoking the delegate cuts off that spender’s access. But draw the distinction carefully: if your seed phrase or private key was leaked — entered on a phishing site, stored in a synced note, pasted into a fake support chat — the attacker controls the entire wallet, and revoking a delegate will not stop them. In that case, move any remaining assets to a brand-new wallet created on a clean device first, then abandon the compromised one entirely. Revoking is the right fix when the exposure was an approval; a new wallet is the only fix when the key itself is out.

Solana token approvals: frequently asked questions

What is a token approval on Solana?

It is a delegate set on one of your token accounts. You name another address as delegate and grant it the right to move up to an approved amount of that specific token without signing again. The approval sits on the account until you revoke it.

Does Solana have infinite approvals like Ethereum?

Not in the same way. Ethereum uses per-spender ERC-20 allowances that are often unlimited and persist. On Solana a token account holds a single delegate and an approved amount, and a new approval replaces the old one — but that amount can be set to your whole balance, which is effectively unlimited for that token.

How do I revoke a token approval on Solana?

Send a Revoke instruction to the SPL Token program for the token account. It clears the delegate and resets the delegated amount to zero. This tool builds and batches that instruction for every delegated account it finds; the spl-token CLI can do it one account at a time.

What does revoking a delegate do?

It clears the token account’s current delegate and resets the delegated amount to zero. Your tokens stay put — nothing is moved or burned. The only effect is that the previously approved spender can no longer transfer them.

Is it safe to revoke token approvals?

Yes. Revoking removes a delegate and nothing else. It cannot move, sell, or burn tokens, and does nothing to an account with no delegate. If you still use the app that set the approval, it will just ask you to approve again next time.

Does revoking cost anything?

No service fee here — only the standard Solana network fee, a fraction of a cent, paid when you sign. Approvals are batched into as few transactions as your wallet supports.

How do approvals get exploited?

A malicious site hides an Approve instruction inside a transaction that looks like a mint, claim, or connect, naming the attacker as delegate. Later, the attacker moves that token out with no further prompt. Revoking the delegate closes that window.

Should I revoke if my wallet was drained?

Revoke if the exposure was an approval. If your seed phrase or private key leaked, the attacker controls the whole wallet and revoking will not help — move remaining assets to a fresh wallet on a clean device and abandon the compromised one.