Privacy, Permissions & Signing Security
This article uses EVM networks and standard ERC-20 permissions as examples. Disconnecting a DApp only ends the local connection between the website and the wallet. The wallet interface that manages this connection has the technical name: Provider. Disconnecting does not change the approved spending amount recorded on the blockchain (Allowance). Revoking the permission requires a transaction. The approved amount is reduced or set to zero only after the transaction succeeds on the correct network. Other crypto tokens, NFTs, and permission systems may follow different rules.
1. What is the difference between disconnecting a website and revoking a permission?
Comparison | Website disconnection | ERC-20 permission revocation |
What changes | The local connection saved by the wallet | The approved spending amount recorded by the token contract ( |
Requires a blockchain transaction | No | Yes |
Usually incurs a network fee | No | Yes. The account submitting the revocation transaction pays the fee in the network's native asset. |
Can change the approved amount ( | No | Yes. A successful transaction can reduce it or set it to zero. |
Scope | The current connection between the wallet and the website | Only the selected network, account, token, and approved party ( |
After disconnection, the website normally cannot send requests to the wallet through the previous connection. However, it can still query a public address it already knows and may ask to connect again. For a full comparison of four common wallet actions, see What Is the Difference Between Wallet Connection, Message Signing, Transaction Signing, and Permissions?.
2. Where is an ERC-20 permission stored?
A standard ERC-20 permission record is identified by five values: the asset owner (Owner), the token contract (Token), the approved party (Spender), the approved spending amount (Allowance), and the network. After a transaction that executes the approval function (approve) succeeds, the new approved amount is written to the token contract on the blockchain. It is not stored in the browser cache or wallet client.
If the approved amount, the asset owner's token balance, and the token contract rules all permit it, the approved party can use a contract function, for example transferFrom, to transfer crypto tokens. Whoever submits this contract operation must send a transaction and pay the network fee. The asset owner normally does not need to provide another signature for this transferFrom operation. Closing the website, removing the connection record, changing phones, or reinstalling the wallet does not change the approved amount on the blockchain.
Scope note: Different rules may apply to a permission for one NFT, a permission for all NFTs (setApprovalForAll), Permit2, and permissions on non-EVM networks. Their revocation methods may also differ. Do not assume that every permission can be revoked by setting an ERC-20 approved amount to zero.
3. Do permissions expire automatically? What does a Permit expiration time mean?
Standard ERC-20 approved amount (
Allowance): It normally has no default expiration time. It remains until it is spent, replaced with a new amount, or reduced or set to zero by a transaction. A particular token contract may behave differently.Limited permission: A limit caps the amount of crypto tokens that may be used; it does not set an expiration time.
Signature expiration (
deadline): In mechanisms such as ERC-2612, this field normally limits when a signed permission message can be submitted. Creating the signed message (Permit) does not immediately change the approved amount on the blockchain. The signed message must be submitted successfully. At that time, its sequence value (nonce), expiration time (deadline), and other validation conditions must still be valid. Only then can the permission take effect. Once the permission takes effect, its approved amount does not disappear merely because the original message has expired.
Long-lived or unlimited permissions can increase ongoing exposure. See What is Unlimited Approval?.
4. What should I check when revoking a permission?
Confirm the network and account: Revoking a permission on one network does not change permissions on another network.
Confirm the token and approved party (
Spender): Do not rely only on names or icons. Verify the contract address and the approved party.Choose the correct revocation action: When revoking a standard ERC-20 permission, reduce the approved amount or set it to zero as appropriate. Follow the relevant contract standard and official instructions for other permission types.
Prepare the network fee: Revoking an ERC-20 permission normally requires a blockchain transaction. The submitting account needs the network's native asset to pay the fee.
Wait for successful execution, then check again: Signing or broadcasting the transaction does not mean the revocation has taken effect. Query the approved amount on the blockchain (
Allowance) again only after the transaction has been included in a block and executed successfully.
Some hardware devices cannot fully decode every contract or revocation parameter. Check the network, transaction type, contract, and readable fields actually shown on the device. If essential information is missing, differs from what you expect, or can only be blind-signed, stop and verify the request again. See What Should I Check Before Confirming a Transaction on a Hardware Wallet?.
5. Frequently asked questions
Does closing the browser or uninstalling the wallet remove an existing blockchain permission?
No. These actions do not change contract state on the blockchain.
My account currently has a zero balance for this ERC-20 asset. Should I still review an old permission?
Consider how the account may be used later. If the same ERC-20 asset is sent to the address again, a valid approved amount may still let the original approved party use transferFrom to transfer it.
Does one revocation cover every network?
No. Permissions are normally recorded separately for each network, account, token contract, and approved party. Check each one individually.
Why does a permission still appear after I revoked it?
Confirm that the revocation transaction executed successfully, that you are viewing the correct network and account, and whether the displayed permission is an ERC-20 approved amount, an operator permission for NFTs (NFT Operator), or another permission type.
Key principle: Disconnect local connections that are no longer in use. If a blockchain permission is no longer needed, first verify the network, account, token contract, and approved party. Then remove that permission according to the relevant permission standard.