Yes, you need to revoke them. When a DApp changes its contract, the approvals you gave to the old contract do not simply go away. They sit on-chain like a lost key you forgot about.
Step 1: Understand Why Old Approvals Are a Ticking Time Bomb
[What to do] Figure out the exact conditions that turn an old approval into a risk.
[How to do it] Look at the three risk paths below. You will see that "only the frontend changed" is not the same as having your on-chain security wiped clean:
Contract bugs: The old contract itself may have flaws, or malicious code may have been added through an upgrade. Attackers can exploit those flaws, call the old contract, and use your approval to drain your assets.
Privilege abuse: Even if the old contract has no bugs, its admin keys could be leaked, or the contract could be abandoned. Whoever controls it can still misuse your approval.
Automated scanning: AI and automated tools now scan old contracts and forgotten approvals in bulk, making attacks much cheaper. An approval that was safe in the past and then forgotten can become a target today.
[Completion criteria] You can clearly say: "The old contract is offline" does not mean "on-chain risk is gone." Old approvals are permissions that stay active.
Step 2: Check and Revoke Approvals to the Old Contract
[What to do] Use an approval management tool to find and cancel any allowances you gave the old contract.
[How to do it] It only takes three steps:
Open a tool: Go to an approval manager like revoke.cash or revokescout.com.
Connect your wallet: Choose the network where the old contract lives (such as Ethereum or BSC) and connect your wallet.
Find and revoke: Look through the list for entries you don't recognize or that match the old project name. Click "Revoke," then confirm the transaction in your wallet and pay the gas fee.
High-risk warning: Disconnecting your wallet from a DApp's website does not protect you from approval-based attacks. Doing that only hides your address from the frontend. Your approval for the smart contract remains valid. Revoking the approval is the only real fix.
Common reason this fails: Many people click "Max" or "Unlimited" approval inside a DApp to save time. That is like giving a stranger a master key to your vault. Get into the habit of approving only what you need and revoking right after—it dramatically reduces your risk.
Step 3: When to Revoke Now, and When You Can Wait
[What to do] Use different strategies for different kinds of approvals.
[Completion criteria] You can judge the approvals in your wallet instead of just acting blindly.
| Situation | Advice | Reason |
|---|---|---|
| Old contract is completely abandoned | Revoke immediately | You no longer use it; keeping it is just risk |
| Well-known protocol (e.g., Uniswap) | Check regularly; you can keep or revoke | Safer than average, but never risk-free. Keep it if you use it often, revoke it if you want peace of mind. |
| Unknown or copycat DApp | Revoke immediately | Extremely risky; clean it up as soon as you finish using it |
How to check that it worked: After revoking, refresh the Revoke.cash page and make sure the approval entry is gone from the list. You should also see a transaction in your wallet's history with a status of "success" and an amount of 0 for the approval revocation.
