How it works
Token Approvals
How the Token Approvals page finds every approval and account permission a wallet has granted, rates it and revokes it.
Updated 2026-10-10
What it covers
An approval lets another address move your tokens. Token Approvals lists every approval that is still in force, on every supported mainnet at once (testnets are one switch away):
| Type | What the spender can move |
|---|---|
| Token | Up to the approved amount of one ERC-20 token |
| NFT | One NFT from a collection |
| NFT collection | Every NFT you hold in the collection, now and later |
| Permit2 | Tokens through Uniswap's Permit2 contract, up to an amount and until an expiry date |
How a scan works
- 01
Find the approval events
Every approval leaves an event with your address in it. zkCodex asks Blockscout or Etherscan for exactly those events over the whole history of each network: usually one request per network. When that explorer does not answer, the same events are read from the other one, or from the network's own Blockscout explorer where Etherscan does not serve it, and the result is just as complete.
- 02
Check each one live
The current allowance is then read from the token contract itself in one batched call, so approvals that were used up, revoked or moved away with the NFT do not show.
- 03
Identify the spender
Known protocols come from zkCodex's own list; other spenders from the explorer (name, verified source, scam flags) and from the chain (a contract or a plain wallet). Spenders still without a name get a Blockscout Metadata name tag when one exists, which also names spenders on networks where only verified source names were known. A warning tag (phishing, hack, drainer, sanctioned) is kept even when the address has a name, unless the name belongs to an exchange, a bridge, a DEX or a protocol: explorers name phishing addresses too (Fake_Phishing123).
Nothing is stored by zkCodex
Each scan is read fresh from the explorers and the chain. The last result is kept only in your browser, so the page opens instantly next time and checks again in the background.
Risk levels
| Level | When |
|---|---|
| Critical | The spender is flagged as malicious, or a plain wallet can move an unlimited amount or a whole collection |
| High | A plain wallet can move tokens, or an unidentified contract has an unlimited or collection-wide approval |
| Medium | An unlimited or collection-wide approval to a known contract, or a limited approval to an unidentified one |
| Low | A limited approval to a known contract |
Value exposed is what the spender could move today: the approved amount, capped by your balance, at the current price.
Spam tokens emit fake approval events in popular wallets' names. Approvals are hidden by default when the token is flagged or advertises a link in its name, when an unlisted token has no price or is not in your wallet, and when you hold none of an NFT collection. A switch shows them.
Wallet Health
A Wallet Health panel opens the page: Looks fine, Review or At risk for the networks scanned, with the findings behind it. It counts approvals to flagged spenders or plain wallets and dangerous or unidentified EIP-7702 code as critical, unlimited approvals and unknown spenders as worth a review, and old approvals, delegate.xyz delegations and spam or unlisted tokens you hold as information. Hidden spam approvals never count.
Account permissions
Some permissions sit on the account itself rather than on a token. The page checks two kinds on every network in the same scan.
| Permission | What it means | How to remove it |
|---|---|---|
| EIP-7702 smart-account code | The wallet runs a contract's code. Wallets such as MetaMask, Coinbase, Ambire and OKX use this for their smart-account mode. | Only in the wallet itself (in MetaMask: Account details, Smart account). A website cannot remove it. |
| delegate.xyz and Warm.xyz delegations | Another wallet may claim airdrops, mint allowlist spots and pass token checks for you. It cannot move your tokens. | Revoke on the page, one by one or all at once. |
Sweeper code means the key is exposed
Most 7702 delegations seen in the wild point at sweeper contracts that forward every incoming coin to an attacker. When the page finds one, the private key is already in someone else's hands: move what is left to a new wallet. Revoking approvals or removing the delegation does not fix a leaked key.
Revoking
- Revoke sets an approval to zero. It never raises or edits an allowance.
- Every revoke call is simulated first; one that would fail is skipped and reported.
- Before anything is signed, the page checks the wallet holds enough of the network's coin to pay the gas, and says how much is missing.
- Smart wallets that support batched calls revoke a whole network in one confirmation. Other wallets confirm one transaction per approval.
- Permit2 approvals on the same network are revoked together in a single Permit2 call.
- Only the wallet that owns the approvals can revoke them. Any address or ENS name can be checked.
- A revoked approval leaves the list as soon as its transaction confirms; the rest of the page stays as it is. The page checks the networks again in the background a little later.
XP for revoking
Every approval you revoke on this page earns 1 bonus XP, up to 15 XP per wallet in a UTC day. Revokes past the limit still work; they just earn no more XP that day. After a revoke, a share card shows what you removed and the XP it earned.
- Only revokes sent from the zkCodex page count: the transaction carries zkCodex's builder code.
- The approval must have been in force just before the revoke. Revoking an approval that was already zero earns nothing.
- Each approval counts once, and a transaction older than a day no longer counts.
- Removing a delegate.xyz or Warm.xyz delegation earns no XP.
- Revokes on testnets earn testnet XP with their own 15 XP daily limit. It never mixes with mainnet XP.
- Revoke XP is bonus XP, like tasks: no fee goes to zkCodex, so it does not count as paid XP.