You have interacted with dozens of smart contracts. Some were legitimate DEX trades. Others were yield farming protocols you forgot about months ago. A few might have been phishing sites that tricked you into signing a malicious transaction without realizing it.
The problem is that most of these interactions leave permanent on-chain permissions. A token approval you signed six months ago is still active right now. A WalletConnect session from a sketchy dApp might still have access. And if any of those contracts get compromised tomorrow, your funds are gone with no further action required from you.
This guide walks through a complete on-chain audit of your own wallet. Every step uses free, publicly available tools. By the end, you will know exactly which contracts have permission to touch your tokens and which interactions pose a risk.
BLUF: Audit your wallet in five steps — (1) list every contract you have ever interacted with, (2) check active token approvals and revoke unused ones, (3) review all signed messages for blind signatures, (4) identify suspicious or unknown contracts in your history, (5) verify your wallet labels and exposure. Do this quarterly. If you find approvals to contracts you do not recognize, revoke them immediately.
Why You Need to Audit Your Wallet
Most wallet security advice focuses on prevention: use a hardware wallet, never share your seed phrase, avoid phishing links. These are important, but they do not address the permissions you have already granted.
Every time you interact with a DeFi protocol, you create two types of lasting exposure:
| Exposure Type | What It Means | How Long It Lasts |
|---|---|---|
| Token approval | A contract can spend your tokens up to the approved amount | Until you explicitly revoke it |
| Allowance signature | You signed a permit or off-chain message | Varies — some are one-time, others persist |
A wallet drainer does not need to hack your wallet. It needs you to sign one bad transaction, once. After that, the permissions you granted do the rest — silently, sometimes months later.
Real-World Scenario
In January 2024, a user connected their wallet to what appeared to be a legitimate staking dApp. They signed a single transaction they did not fully understand. Six months later, the dApp’s contract was upgraded via a proxy pattern, and the attacker drained 12 ETH from the wallet using an approval the user had completely forgotten about.
The approval was visible on-chain the entire time. A 10-minute wallet audit would have caught it.
Step 1: Map Your Contract Interactions
The first step is to create a complete inventory of every smart contract your wallet has ever interacted with.
Using a Block Explorer
- Go to Etherscan (or the appropriate explorer for your chain — Basescan, Arbiscan, Solscan)
- Search your wallet address
- Go to the Internal Transactions tab — this shows every contract that called your wallet or was called by your wallet
- Note the contract addresses you do not recognize
Using Arkham Intelligence (Free Tier)
Arkham provides a visual interface for wallet activity that makes it easier to spot anomalies:
- Go to arkhamintelligence.com and search your address
- Review the Transfers tab for any tokens sent to addresses you do not recognize
- Check the Platforms tab to see which protocols your wallet has interacted with
What to Look For
| Signal | Risk Level | Action |
|---|---|---|
| Contracts you recognize (Uniswap, Aave, etc.) | Low | No action needed |
| Contracts from protocols you stopped using | Medium | Revoke approvals (Step 2) |
| Contracts you do not recognize at all | High | Investigate immediately |
| Contracts that received token transfers you did not initiate | Critical | Possible compromise — move funds |
Step 2: Audit Active Token Approvals
Token approvals are the single most dangerous lingering permission. Every approval gives a smart contract the right to move your tokens without asking again.
How to Check Your Approvals
Option A: revoke.cash (Recommended)
revoke.cash is a free tool that aggregates all active approvals across multiple chains:
- Connect your wallet (read-only — no signature required)
- Review every active approval, sorted by token and contract
- Click Revoke next to any approval you do not need
Option B: Etherscan Token Approval Checker
- Go to Etherscan and search your address
- Navigate to the More dropdown → Token Approvals
- You will see a table of every contract with an active allowance
What to Revoke
| Approval Type | Action | Why |
|---|---|---|
| Unlimited approval to a DEX you still use | Consider revoking and re-approving with exact amounts | Reduces blast radius if DEX is compromised |
| Approval to a protocol you stopped using | Revoke immediately | Unused approvals are pure risk |
| Approval to a contract you do not recognize | Revoke immediately and investigate | May be a phishing contract |
| Approval with zero balance | Low priority but clean it up | Risk activates if you receive tokens later |
For a deeper explanation of why unlimited approvals are dangerous, see our token approval safety guide.
Step 3: Review Signed Messages and Blind Signatures
Token approvals are on-chain transactions. But many attacks use off-chain signatures — messages you sign that do not cost gas but grant permissions in other ways.
The Blind Signing Problem
When you sign a transaction on a hardware wallet or mobile wallet, the screen shows you what you are approving. But if the data is not human-readable — just a hex string — you are blind signing. This is how most signature scams work.
How to Check Your Signatures
Signing history is harder to audit than approvals because off-chain signatures are not always stored on-chain. However, you can check:
- Etherscan → Internal Txns: Look for transactions where your wallet called
permit()orpermitMulti()— these are signature-based approvals that bypass the normalapprove()flow - Your wallet’s signing history: MetaMask and Rabby store a local log of signed messages. Check your wallet settings for a signature history or activity log
- Arkham Intelligence: Look for interactions with known signature-phishing contracts
Red Flags in Signature History
| Pattern | What It Means |
|---|---|
| You signed a message on a site you do not remember visiting | Likely a phishing site that tricked you |
You called permit() on a token you did not intend to approve | An eth_sign phishing attack |
| You signed a Permit2 permission on an unknown contract | Permits are transferable — the contract can be changed later |
If you find any of these, the approval may still be active. Check revoke.cash and revoke any Permit2 permissions to unknown contracts.
Step 4: Identify Suspicious Contracts
Your transaction history is a map of every smart contract that has ever touched your wallet. Most are legitimate. A few might be dangerous.
How to Screen a Contract
For each unknown contract in your history, run this checklist:
1. Is the source code verified?
Go to the contract on Etherscan. If the Contract tab shows verified source code, it is a legitimate deployer. If it shows only bytecode, the contract is opaque — higher risk.
2. Does the contract appear on known-phishing databases?
Check the contract address against:
- Chainabuse — community-reported scam addresses
- ScamSniffer — real-time phishing detection
- Your wallet’s built-in scanner (Rabby, MetaMask with security plugins)
3. What does the contract do?
If verified, read the contract code. Look for:
transferFrom()calls that can move tokens without explicit per-transaction approvaldelegatecallto an upgradeable implementation — the logic can change- Functions named
claim(),sweep(), ordrain()— common in malicious contracts
4. Who else has interacted with it?
On Etherscan, check the contract’s transaction history. If hundreds of wallets interacted with it within a short window and many subsequently sent tokens to the same address, it is likely a drainer.
Contract Risk Classification
| Risk Level | Criteria | Action |
|---|---|---|
| Safe | Verified, well-known protocol (Uniswap Router, Aave, etc.) | No action |
| Low | Verified, small protocol, source is readable | Revoke approval if unused |
| Medium | Verified but uses proxy or has owner privileges | Monitor for upgrades |
| High | Unverified, or matches phishing database | Revoke all approvals, move funds |
Step 5: Check Your Wallet Labels and Exposure
Wallet labels are tags assigned by on-chain analytics firms to categorize addresses. If your wallet has been labeled, it affects how protocols treat you — and how attackers target you.
How to Check Your Labels
- Arkham Intelligence: Search your address and check the Labels section
- Etherscan: The address page may show a name tag if you have interacted with labeled entities
- Nansen (paid): Comprehensive labeling, but the free Arkham tier covers most needs
Why Labels Matter for Security
Labels reveal your wallet’s exposure profile:
| Label | Security Implication |
|---|---|
| DEX Trader | You have many active approvals — audit them |
| DeFi Power User | High interaction count — more attack surface |
| Whale | You are a high-value target for phishing campaigns |
| No label | You may be flying under the radar — good for security |
Understanding your wallet’s public profile helps you calibrate your security posture. A whale wallet with 50 active approvals is a sitting duck. A small wallet with 3 approvals to major protocols is low risk.
Building a Wallet Audit Habit
A one-time audit is better than nothing, but wallet security is ongoing. Every new dApp interaction adds to your attack surface.
Recommended Audit Cadence
| Frequency | What to Check | Time Required |
|---|---|---|
| Weekly | Quick check: any new approvals from the past week | 2 minutes |
| Monthly | Full approval audit on revoke.cash | 10 minutes |
| Quarterly | Complete 5-step audit described in this guide | 30 minutes |
| After any new dApp interaction | Verify what you just approved | 2 minutes |
Wallet Segmentation Strategy
The most effective security practice is to use separate wallets for different risk levels:
| Wallet | Purpose | Risk Level | Funds Kept |
|---|---|---|---|
| Cold storage | Long-term holdings | Minimal | Majority of assets |
| DeFi wallet | Active trading and yield farming | Medium | Only what you are actively using |
| Experimental wallet | New dApps, airdrop farming, test contracts | High | Minimal — treat as disposable |
If your experimental wallet gets drained, your cold storage is untouched. This segmentation is more effective than any single security tool.
Tools Summary
| Tool | Purpose | Cost |
|---|---|---|
| revoke.cash | Audit and revoke token approvals | Free |
| Etherscan | Transaction history, contract verification | Free |
| Arkham Intelligence | Visual wallet analysis, labels | Free tier |
| Chainabuse | Report and check scam addresses | Free |
| ScamSniffer | Real-time phishing detection | Free |
Limitations
This audit covers on-chain activity only. It cannot detect:
- Off-chain malware: Keyloggers, clipboard hijackers, or browser extensions that replace addresses
- Social engineering: Someone convincing you to send funds voluntarily
- Address poisoning attacks that trick you into sending to a look-alike address
- Custodial risk: Funds on exchanges are not protected by wallet auditing
For comprehensive security, combine regular on-chain audits with hardware wallet usage, a dedicated browser for DeFi activity, and healthy skepticism toward unsolicited messages.
Frequently Asked Questions
How often should I audit my wallet?
At minimum, run a full approval check on revoke.cash once a month. Do a complete 5-step audit quarterly. Always audit immediately after interacting with a new or unfamiliar dApp.
Can auditing my wallet prevent all hacks?
No. Audits catch lingering permissions and suspicious past interactions, but they cannot prevent real-time phishing attacks or zero-day contract exploits. Audits reduce your attack surface — they do not eliminate it. Combine auditing with hardware wallet usage and transaction simulation.
What if I find an approval to a contract I do not recognize?
Revoke it immediately on revoke.cash, then investigate the contract address on Etherscan. If the contract is unverified or appears on phishing databases, consider moving your funds to a fresh wallet address.
Does revoking an approval cost gas?
Yes. Revoking is an on-chain transaction that sets the allowance to zero. On Ethereum mainnet, this typically costs $5–20 in gas depending on network conditions. On Layer 2 networks like Base or Arbitrum, the cost is usually under $0.10.
Is it safe to connect my wallet to revoke.cash?
Yes. revoke.cash only needs read access to your approval data. It does not request token transfers or permission to spend. When you revoke, the transaction is initiated from your wallet — revoke.cash cannot act without your explicit confirmation.