Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Testnet permissions, dapp connections, token allowances, and leaked private keys are different security problems. Revoke a testnet allowance only on that testnet; inspect and revoke mainnet allowances separately. Disconnecting a dapp does not remove an on-chain allowance. If a recovery phrase or private key was exposed, revocation is not enough: create an unrelated wallet with a new recovery phrase and move assets and control as quickly and safely as possible.
What exactly was exposed?
Start by identifying the permission or credential before taking action. The remedy depends on whether you signed a testnet token approval, connected a site, granted a token or NFT allowance, or exposed a signing key.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Situation | What it means | Correct response |
|---|---|---|
| Testnet approval only | A contract on one test network can spend assets on that network under the approval. It does not create a mainnet allowance. | Revoke it on the same testnet if you want to clean up; inspect mainnet separately if the wallet was used there. |
| Dapp connection only | The site can remain connected to the wallet interface. A connection is not an on-chain spending permission. | Disconnect the site in your wallet, then check allowances independently. |
| Token or NFT allowance | An on-chain approval lets a specified contract move an approved token amount or act on approved NFTs on that network. | Submit a revocation transaction on that network, pay the network fee, and verify the resulting state. |
| Exposed private key or recovery phrase | Someone with the credential may be able to sign as the affected account or every account derived from the phrase. | Create fresh, unrelated credentials and migrate assets and required control. Revocation alone cannot neutralize the key. |
MetaMask describes the Secret Recovery Phrase (SRP) as the source from which wallet accounts are derived, while an individual private key controls one account. Creating another account under a suspected phrase does not create an independent security boundary. If the phrase itself may have been copied, every account derived from it should be treated as exposed.
Are testnet approvals dangerous to mainnet funds?
A testnet approval is not a mainnet allowance. Revoke.cash explains that an approval signed on Sepolia is invalid on Ethereum Mainnet, and contracts deployed on different networks maintain separate state. A testnet-only approval therefore does not, by itself, grant a spender access to your mainnet tokens.
Popular on Amazon
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
That separation is not a reason to skip an inventory. Wallet addresses are often reused across networks, and a person who interacted with a testnet dapp may also have used the same address on mainnet or another chain. Check every network on which the wallet signed approvals. An Ethereum Mainnet approval checker will not display Polygon, Arbitrum, Base, BNB Chain, or testnet allowances unless it explicitly supports and is set to that network.
Cleaning up testnet approvals is optional from a mainnet-funds perspective. It can reduce clutter and remove a permission from the test environment, but it does not replace a mainnet review. Conversely, revoking a mainnet allowance does nothing to a separate allowance on Sepolia or another testnet.
Recommended Free Tools
Is disconnecting a dapp enough?
No. Disconnecting controls the wallet-to-website session; revoking controls an on-chain contract permission. They are separate operations.
When a site is connected, it may be able to request account information or present signing requests through the wallet. A token approval, however, is recorded by the token contract on the blockchain. The allowance remains after you disconnect the site until a new transaction changes it. Use your wallet’s connected-sites screen to disconnect a site you no longer trust, then use an allowance checker or supported wallet view to inspect token and NFT permissions.
Disconnecting is still useful. It prevents the site from making new wallet requests through an existing connection, but it cannot erase a transaction already confirmed on-chain. If you reconnect later, the site may ask for a fresh connection and, when needed, a fresh approval.
Also popular on Amazon
How do I find every allowance that needs review?
Use a checker that supports the exact network and permission type, or the allowance view provided by your wallet. Ethereum.org lists Etherscan, Blockscout, Revoke, Unrekt, and EverRevoke as examples; availability and chain coverage can change, so confirm that the tool currently supports your network.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- List the networks. Write down each mainnet, layer-2 network, sidechain, and testnet where the wallet signed transactions or connected to contracts. Do not assume one network’s results represent another’s.
- Switch both interfaces to the same chain. Set the wallet and checker to the identical network before reviewing results. If the checker is on Ethereum Mainnet while the wallet transaction is on a testnet, you are looking at different state.
- Connect the correct address. If the wallet contains several accounts, review each address separately. A phrase-derived account and an imported private-key account can have completely different approval histories.
- Inspect the details. For every result, note the token or NFT collection, the spender contract, the allowance amount or operator status, and the network. Do not revoke merely because a contract name is unfamiliar; investigate the transaction and contract context when possible.
- Separate stale from active use. An allowance for a protocol you still use may be convenient, while an approval for an abandoned or suspicious site is a candidate for revocation. Unlimited ERC-20 approvals deserve particular attention because they can cover future deposits as well as current balances.
Some tools show ERC-20 allowances but not NFT operator approvals, permit-style signatures, smart-account modules, or session keys. The cited guidance focuses primarily on Ethereum-compatible token approvals. If your wallet uses a smart account or a non-EVM chain, identify the authorization format and follow that network’s documented controls rather than assuming an ERC-20 checker is complete.
How do I revoke a token or NFT approval?
Revocation is an on-chain transaction submitted on the network that holds the allowance. It consumes that network’s native gas token and is not complete until the transaction is confirmed.
- Open a compatible approval view. Use a wallet-supported allowance screen or a reputable checker that covers the selected chain. Confirm the URL and wallet network before connecting.
- Select the unwanted permission. Check the spender address, token or NFT, current allowance, and chain. For NFTs, distinguish a single-token approval from an operator approval that can act on an entire collection.
- Choose revoke or reset. The interface should show the contract call and the network fee before signing. Revoke.cash notes that ERC-20 approvals are commonly reset to zero and NFT permissions to false, but read the wallet prompt rather than relying on a button label.
- Review the wallet request. Reject requests that ask for an unrelated transfer, a new unlimited approval, or a network switch you did not intend. A genuine revocation should correspond to the permission you selected.
- Sign and wait for confirmation. Submit the transaction only when the wallet is on the same network as the allowance and has enough native gas for that chain. Pending transactions can take time during congestion.
- Verify independently. After confirmation, refresh the checker and inspect the token contract’s allowance or NFT operator state. The entry should disappear, show zero, or show the operator as disabled. You can also open the transaction in a block explorer and confirm that it succeeded on the intended chain.
Revoking does not move your tokens and does not delete your wallet. It changes the contract’s permission state. If you use that protocol again, it may ask you to approve the token or NFT again, adding another transaction and fee. That convenience-versus-standing-access trade-off is why it is sensible to target unused or suspicious approvals instead of blindly revoking every permission.
What should I do if my recovery phrase or private key was exposed?
Assume the affected account is compromised and act before adding more funds. A leaked credential remains valid even after every allowance is revoked. MetaMask’s migration guidance is intended for suspected SRP compromise, unauthorized transactions, or deliberate key rotation.
Also popular on Amazon
- Create a brand-new wallet. Generate it in a trusted wallet environment with a fresh Secret Recovery Phrase or fresh private key. Do not import the old phrase, and do not create a new account under that phrase; those accounts remain derived from the same exposed secret.
- Record and protect the new credentials. Back up the new phrase offline according to the wallet’s instructions. Never paste it into a website, form, chat, cloud note, or browser extension prompt. MetaMask states plainly that it cannot recover a wallet for you, so loss of the new phrase can permanently remove access.
- Inventory what must move. List native coins, ERC-20 tokens, NFTs, liquidity-provider or staking positions, vesting or locked assets, and any smart-contract ownership or administrator roles controlled by the old address. A simple token transfer may not transfer a position or contract authority.
- Plan gas and ordering. Each transfer or ownership change can require a fee. A compromised account may be monitored by a sweeper that immediately takes newly added gas, so do not treat funding the old address first as universally safe. Prepare the transaction sequence and required gas with the risk of instant interception in mind.
- Move assets and control. Transfer assets to the new address and update ownership, withdrawal, multisignature, domain, or protocol-control settings where applicable. For positions with lockups or special exit procedures, follow the relevant protocol’s documented withdrawal path.
- Stop new activity on the old wallet. Once migration is complete, do not deposit into, approve from, or sign new messages with the exposed address. Revoke its remaining allowances where doing so is safe and useful, but treat those revocations as cleanup rather than key rotation.
If an attacker has already transferred assets, revocation cannot reverse the completed transfer. Revoke.cash explains that its service cannot recover stolen funds. Preserve transaction hashes and the exact compromised address for any incident reporting, but do not delay urgent migration while waiting for a revocation to finish.
What is the difference between rotating a private key and changing an account?
Key rotation means moving control to credentials that have no derivation or import relationship to the exposed secret. In a phrase-based wallet, selecting Add account usually creates another account derived from the same SRP; that is not rotation after an SRP leak. A truly fresh wallet must generate a new SRP or an independently generated private key.
An imported single-account key has a narrower blast radius: other accounts are not automatically controlled by that key. Nevertheless, the imported account itself should be treated as exposed, and any contract roles or allowances associated with it must be migrated or replaced. If you are uncertain whether a phrase, private key, JSON backup, hardware-wallet seed, or signing device was exposed, use the more conservative assumption and create unrelated credentials.
How should I choose an approval checker?
No single listed service is established as universal. Compare tools by the coverage they document, then verify the result on-chain.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Decision axis | What to confirm |
|---|---|
| Chain coverage | Does it support the exact mainnet, layer 2, sidechain, or testnet where the approval exists? |
| Permission types | Does it display ERC-20 allowances, NFT token approvals, collection-wide operators, and any other authorization you actually use? |
| Wallet compatibility | Can your wallet connect safely, or can you submit the transaction through the network’s explorer and a wallet you trust? |
| Signing transparency | Does the wallet prompt identify the contract and method clearly enough for you to distinguish a revoke from a transfer or new approval? |
| Independent verification | Can you confirm the transaction hash and resulting allowance in a block explorer or by refreshing a second trusted view? |
Ethereum.org’s guide provides examples of commonly used explorers and revocation services, while MetaMask documents allowance concepts and wallet flows. Their lists are not a guarantee that every chain, wallet, or newer authorization format is covered. Treat a blank result as “not found by this tool,” not proof that no permission exists, when chain coverage is uncertain.
Also popular on Amazon
Can a hardware wallet solve an exposed-key problem?
A hardware wallet can be an optional way to keep a new signing key isolated from ordinary computer malware, but it cannot revoke an old allowance or rescue a phrase that has already leaked. The Ethereum.org security report discusses hardware-wallet usability, supply-chain, and transparency trade-offs; no device should be assumed safe solely because it is hardware.
If you adopt one for the replacement wallet, obtain it through a trustworthy channel, verify its authenticity and firmware instructions, and create the new wallet on the device rather than importing the exposed phrase. You still need to migrate assets and contract control, and you must understand what each transaction request means on the device’s display.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What common mistakes prevent a successful revocation?
- Checking only the testnet. A clean Sepolia result says nothing about an Ethereum Mainnet allowance. Review every network separately.
- Confusing disconnection with revocation. Removing a website connection does not alter the token contract’s allowance.
- Using the wrong account. Wallets with multiple accounts can make it easy to inspect one address while funds and approvals sit on another.
- Ignoring the network fee. Revocation requires a transaction and native gas. A zero balance on that network means the transaction cannot be submitted.
- Signing the wrong prompt. Read the contract, method, spender, and network. Cancel anything that requests a transfer or a new approval instead of the intended reset.
- Assuming zero balance means zero risk. An allowance can matter if tokens arrive later, and a compromised key can sign from the account whenever funds are added.
- Creating a second account under a leaked phrase. Derivation from the same SRP leaves the new account exposed to anyone holding that phrase.
- Funding a compromised wallet casually. A sweeper may take gas immediately. Plan migration and gas handling rather than sending funds first and deciding later.
- Expecting revocation to recover stolen assets. Revocation prevents future permitted transfers; it does not undo a confirmed theft.
What is a safe incident checklist?
- Stop interacting with the suspicious site and disconnect its wallet session.
- Classify the event: testnet-only approval, dapp connection, token/NFT allowance, private-key exposure, or SRP exposure.
- List every network and wallet account involved.
- Inspect approvals on each network with a checker that supports the relevant permission type.
- Revoke unwanted allowances on their respective networks and verify confirmed results.
- If a signing credential was exposed, create an unrelated fresh wallet immediately.
- Inventory assets, NFTs, positions, lockups, and contract roles before moving anything.
- Plan transaction ordering and gas with possible sweeper activity in mind.
- Migrate assets and administrative control, then stop using the old wallet.
- Keep records of addresses and transaction hashes, and treat any already completed transfer as irreversible.
What does this guidance cover, and where does it stop?
The procedure applies most directly to Ethereum-compatible ERC-20 approvals, NFT approvals, and ordinary wallet accounts. Network interfaces, checker coverage, and wallet labels change over time, so confirm the current instructions before signing. Smart-account modules, session keys, permit signatures, exchange permissions, and non-EVM authorization systems may require different controls that are not represented by a standard allowance checker.
The governing rule is to identify the exact permission and chain first. Revoke only the unwanted on-chain permission, verify the confirmed state, and treat any exposed signing secret as a separate emergency requiring fresh credentials and migration.
Frequently Asked Questions
Do testnet approvals affect the same address on mainnet?
No. The address may be identical, but each network keeps its own contract state. A spender approved on Sepolia cannot use that approval against the address’s Ethereum Mainnet balance; mainnet permissions still need their own review.
Also popular on Amazon
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Can I revoke an approval if I have no gas token?
You cannot submit the revocation transaction until the wallet can pay that network’s fee. Obtain gas through a plan appropriate to the account’s risk; if the key may be compromised, avoid casually sending funds to an address that could be swept immediately.
Will revoking an approval delete my tokens or NFTs?
No. A revoke changes the contract’s authority to move them; it is not an asset transfer or wallet deletion. A protocol may ask for a new approval the next time you use it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What if an unauthorized transfer already happened?
Revoking the related allowance can prevent later permitted transfers, but it cannot undo a confirmed transaction. Treat the signing credential as compromised, migrate any remaining assets, and retain the transaction details for incident reporting.
Is a new account under the same recovery phrase actually safer?
Not after the phrase itself was exposed. Accounts created under that phrase remain derivable by whoever has it. Use a newly generated recovery phrase or an independently generated private key, then move assets and control to that unrelated wallet.
