Revoke Risky Approvals#

Most DeFi wallets accumulate token approvals — permissions you granted to contracts to spend your tokens. Some of those approvals are unlimited; many are to contracts you stopped using months ago. If any of those contracts get exploited, the attacker can drain the tokens you approved without ever touching your seed phrase. It's the single most common silent risk in a long-lived DeFi wallet, and almost no one is reviewing it.

What Ava surfaces#

In every portfolio scan, Ava flags:

• Unlimited approvals (the classic MaxUint256 allowance).
• Stale approvals — granted but not used in 90+ days. Stale + unlimited is the worst combination.
• Approvals to unverified or low-reputation contracts.

Each flagged approval shows: which token, which contract, how long ago it was granted, how recently it was used, and the contract's reputation signal.

A typical surfacing#

🟠 You have 7 token approvals that look risky:

1. Unlimited USDC → 0xAbCd… (used 0 times in 92 days)
2. Unlimited WETH → 0xC0fF… (used 0 times in 187 days)
3. Unlimited DAI → 0xDeAd… (unverified contract!)
4. … (4 more)

Want me to prepare the revokes?

How revocation works#

Approval revocation is a transaction you sign from your own wallet. Approvals live on your main wallet, and Ava holds no keys to it.

Ava prepares the revoke for you. A Sign on web link opens Ava Studio, where you tap Confirm and sign in your own wallet — each revoke is a single transaction, and you pay the gas. Ava does the preparation; you do the signing. (You can also revoke with any tool you trust, such as revoke.cash.)

Why Ava doesn't auto-revoke your main wallet's approvals#

Auto runs only from your Ava smart wallet, never your main wallet, so approvals your main wallet gave are yours to revoke: Ava flags, you act — Ava prepares the revoke, you confirm and sign it. (Approvals held by your Ava smart wallet are different: its standard permission covers revoking approvals on the main tokens, so Ava can revoke those after you confirm, without a signature each time.)

How often to do this#

• After any major event (a hack/exploit you read about in a protocol you've used).
• Once a quarter for any wallet you actively use in DeFi.
• Always before topping up a wallet with significant funds.

Ava's job is to make sure you don't have to remember — it'll surface stale risky approvals every scan.

A common gotcha#

Many "scam wallet drainer" attacks rely on the victim having a stale unlimited approval to a compromised contract. The drain happens via the existing approval; the user signs nothing at attack time — because they already signed the approval months ago. Reviewing stale unlimited approvals quarterly is the single biggest preventative measure most users skip.