Install Chain Insights
← All stories

Safety Academy · Story 05 · Old spending permissions

Disconnected. Still invited.

Vera closes a swap site. Its spending permission did not close with it.

Estimated 4 min read

OLD SPENDING PERMISSIONS6 scenes

Vera tries a swap with 25 USDC.

Vera swaps 25 USDC using a trading site. During setup she accepts an unlimited USDC approval for spender 0xC814…20B7. Her wallet holds more than this one purchase needs.

Vera
“One small swap. Nothing dramatic.”
Illustration: Vera tries a swap with 25 USDC.

The swap amount and the requested spending limit can be different.

Vera leaves. The permission stays.

After the swap, Vera disconnects the site from her wallet and closes the tab. The scammer is delighted by a common misunderstanding: disconnecting a site does not cancel an on-chain allowance.

The Scammer
“I do like a generous permission slip.”
Illustration: Vera leaves. The permission stays.

An allowance applies to a particular token and spender. Check both and the amount.

The old spender is still on the list.

Later, Vera opens her wallet’s permission manager. The old spender still has an unlimited USDC allowance. She assumed the disconnect button had ended everything.

Vera
“I disconnected. Why are you still invited?”
Illustration: The old spender is still on the list.

Disconnecting a website does not change an on-chain token allowance.

Captain Harold checks the permission that remained.

Captain Harold separates two controls: connection lets a site interact with a wallet interface; token approval authorizes a spender. A malicious or compromised spender can use a remaining allowance without a fresh approval click.

Captain Harold
“I closed the tab too. The permission did not get the hint.”
Illustration: Captain Harold checks the permission that remained.

An old allowance can matter after the original visit ends.

Vera revokes the unused allowance.

Vera reaches a trusted allowance tool independently, revokes the unused permission and waits for confirmation. She checks that this spender’s USDC allowance is now zero.

Vera
“This permission has outstayed its welcome.”
Illustration: Vera revokes the unused allowance.

Reach the approval tool independently. A fake “revoke” site can itself be a trap.

The old permission no longer covers future USDC.

The old USDC permission is gone. For her next legitimate trade, Vera reviews the requested asset, spender and limit before approving. Revoking could not return funds already taken.

Vera
“Small swap. Small permission. Better.”
Illustration: The old permission no longer covers future USDC.

The habit: review spending permissions, not just connected websites.

The useful bit

Disconnecting a site does not revoke its spending allowance.

  1. Review existing token allowances, including permissions left after disconnecting a site.
  2. Use the linked MetaMask permission guide. Verify the network, asset and spender, then confirm any revocation completed.
  3. For new approvals, limit the amount to what the intended action needs.

I already did this

Use MetaMask’s guide to revoke the unwanted allowance on the correct network and confirm it completed. Disconnecting alone leaves it active. Revocation cannot recover funds already taken. Exposed recovery words require a new wallet, not just revocation.

Sources & further reading