Key takeaways
- A Solana token approval is a delegate stored on one token account, set with the Approve instruction, that can transfer or burn up to a delegated amount without the owner signing again.
- Each Solana token account has at most one delegate, and a new Approve replaces the old one, unlike ERC-20 allowances, which are set per spender and can stack up for many apps.
- Revoking a Solana token delegate costs only the network fee of about 0.000005 SOL per transaction, and one transaction can revoke many token accounts at once.
- A frozen Solana token account cannot be revoked, because the token program rejects every instruction on a frozen account, Revoke included, until the freeze authority thaws it.
- Revoking delegates does not protect a Solana wallet whose seed phrase or private key has leaked, and it cannot undo a transfer, a SetAuthority or a Token-2022 permanent delegate.
The short answer
To revoke token approvals on Solana, find every token account that has a delegate and send a Revoke instruction for each one, signed by the account's owner. You can do it from Solflare's Spending Approvals screen, with spl-token revoke <ACCOUNT> on the command line, or with a free scanner that batches many revokes into one transaction. The cost is the network fee, about 0.000005 SOL per transaction. Most Solana wallets have no approvals at all, so the check usually takes seconds.
What is a token approval on Solana?
A token approval on Solana is a delegate: an address that the owner of one token account has allowed, with the token program's Approve instruction, to transfer or burn up to a set number of tokens from that account. The token account stores two fields for this, delegate and delegatedAmount. Once they are set, the delegate can move tokens with its own signature, without you signing again, until the allowance runs out or you revoke it.
Four rules define how far an approval reaches:
- It covers one token account. Approving a delegate on your USDC account says nothing about your BONK account or your SOL.
- There is one delegate per account. A new Approve replaces the old delegate and amount; it does not add a second one.
- The allowance counts down. Each transfer or burn by the delegate reduces
delegatedAmount, and the delegate field clears when it reaches zero. - The owner can remove it at any time. Revoke clears both fields. On Token-2022 accounts the current delegate can also revoke itself.
Both the original SPL Token program and Token-2022 work this way. If token accounts themselves are unfamiliar, what a Solana token account is explains the structure.
How are Solana approvals different from Ethereum allowances?
Solana approvals are narrower and much rarer than ERC-20 allowances. On Ethereum, an allowance is set in the token contract for each pair of owner and spender, so every DeFi app you use typically adds one, often for an unlimited amount, and they accumulate for years. On Solana, a transaction lists every account it touches and your signature authorizes the token movement directly, so a swap or deposit normally needs no standing approval.
| Solana delegate | ERC-20 allowance | |
|---|---|---|
| Where it is stored | On one token account | In the token contract, per spender |
| How many at once | One per token account | One per spender, unlimited spenders |
| Typical use | Some staking, order, escrow and older NFT listing designs | Almost every DeFi interaction |
| Common size | A set amount, sometimes the whole balance | Often unlimited |
| Removed by | Revoke, signed by the owner | Setting the allowance to zero |
| Cost to remove | About 0.000005 SOL per transaction, many per transaction | One gas-paying transaction per allowance |
The practical result: on Ethereum, revoking old allowances is routine hygiene. On Solana it is an occasional check, plus a specific response after you have signed something you regret.
When is a token approval dangerous?
A token approval is dangerous when you cannot say which app set it and it covers a meaningful share of a valuable balance. Drainer sites sometimes add an Approve instruction to a transaction that looks like a claim or a mint, so the theft happens later, through the delegate, rather than at the moment you sign.
Treat a delegate as suspect when:
- The delegate address does not match any program or app you recognize when you look it up in an explorer.
- The delegated amount equals or exceeds your balance in that account.
- The token is valuable: a stablecoin, a liquid staking token or a large position.
- It appeared shortly after you signed something on an unfamiliar site.
A delegate you can trace to a protocol you actively use, such as an open limit order or a listing, is normal. Revoking it will simply stop that feature until you approve again.
How do you find the token approvals on your wallet?
You find token approvals by reading the delegate field of every token account your wallet owns, because there is no single wallet-level list on chain. At the time of writing, in October 2026, the options are these.
Solflare. Solflare's help center gives the path Settings, Security and Privacy, Spending Approvals for reviewing and revoking approvals. Solflare also warns when you are about to sign a transaction that changes a token account's delegation, with a message that the transaction "will allow your funds to be spent at a future date without your approval".
Phantom. Phantom's help center does not describe a built-in approvals screen for Solana. It points users to a third-party revoker from Famous Fox Federation, and it stresses that disconnecting an app is not the same as revoking an approval.
A block explorer. An explorer's page for an individual token account shows the delegate when one is set. That works for checking one account you are worried about, but a wallet with two hundred token accounts would mean two hundred pages.
A read-only scanner. I built the Revoke Delegations tool because I wanted the whole wallet in one view. Paste any address, no connection needed, and it reads every SPL Token and Token-2022 account the address owns, lists those with an active delegate together with the delegate address, the allowance and your balance, and flags allowances that cover the full balance. It also points out two powers that Revoke cannot remove, covered below. A wallet with none gets a plain "No active delegations" result.
If you are trying to understand where an approval came from, paste the signature of the suspect transaction into the Transaction Decoder, which lists every instruction, including any Approve, in plain language.
How do you revoke a token approval?
You revoke a token approval by signing a transaction with a Revoke instruction for each token account, from the wallet that owns those accounts. Every route below sends the same instruction; they differ in convenience, not in effect.
- In your wallet. In Solflare, open Settings, Security and Privacy, Spending Approvals and revoke from there. This costs only the network fee.
- With the Solana CLI.
spl-token revoke <TOKEN_ACCOUNT_ADDRESS>revokes the delegate on one account, signed by the owner keypair the CLI is configured with. It is free beyond network fees, but it needs your key in a keypair file, which most browser-wallet users do not have and should not create casually. - With a third-party revoker. Connect the wallet, review the list, sign. Check what the transaction contains before approving: a revoke transaction should hold nothing but Revoke instructions and should show no balance changes beyond the fee.
- With SOLTidy's Revoke Delegations tool. Connect the wallet, tick the delegations to remove and sign. Each becomes a Revoke instruction, many fit in one transaction, and SOLTidy charges nothing; you pay only the Solana network fee of about 0.000005 SOL per transaction.
If you are tidying the wallet anyway, the Solana wallet cleanup on the home page includes a token approvals row in the same scan as empty token accounts, stake and NFTs. Approvals there are never pre-selected: you choose each revoke yourself, and it stays free while the rest of the cleanup carries its own tools' fees.
After a revoke confirms, the delegate address can no longer move or burn anything from that account. Your balance does not change, and you can undo the revoke only by signing a new Approve. If the account is empty and you no longer use that token, closing it is just as good: the delegate disappears with the account and you get its rent back, as shown in closing Solana token accounts with the CLI.
Why can't a frozen token account be revoked?
A frozen token account cannot be revoked because the token program rejects every instruction that includes a frozen account, Revoke included, until the token's freeze authority thaws it. Solana's token documentation is explicit that instructions on a frozen account fail until a ThawAccount. If the freeze authority has since been revoked, a frozen account stays frozen permanently.
The good news is that the delegate is stuck too: a frozen account's tokens cannot be transferred or burned by anyone, so the allowance is unusable while the freeze lasts. The Revoke Delegations tool marks these accounts as frozen and leaves them out of the batch so the rest goes through, and the home cleanup skips them. Why an issuer can freeze your account in the first place is covered in mint authority vs freeze authority.
What does revoking a token approval not fix?
Revoking removes ordinary per-account delegates and nothing else. It does not cover:
- A leaked seed phrase or private key. Whoever holds the key can sign a fresh Approve or transfer directly. If your wallet has already been emptied, what to do after a Solana wallet is drained puts moving to a new seed first and revoking later.
- Transfers that already happened. Solana transactions are final; a revoke stops future use of an allowance, not past use.
- SetAuthority and Assign. A drainer that changed the owner of a token account, or reassigned a stake account's withdraw authority, has taken control, not an allowance.
- A Token-2022 permanent delegate. It is set on the mint by the issuer, applies to every holder and cannot be revoked by you. The only defense is not holding that token; Token-2022 explained for traders shows how to spot it.
- A foreign close authority. It can close the account once empty and collect its rent deposit, but cannot touch your tokens.
That is why a clean approvals scan is reassuring but not a clean bill of health. The habits that prevent most losses, mainly reading every simulation and keeping your seed offline, are in the Solana wallet security checklist.
How often should you check Solana token approvals?
Check every few months, and immediately after signing anything on a site you now distrust. Because most Solana apps never ask for a delegate, a typical active trader's wallet shows zero approvals on most scans, and a free read-only check costs nothing. Before trading a new token, it is also worth checking the token itself with the Rug Check, which flags permanent delegates and freeze authorities that no wallet-side revoke can undo.
Bottom line
A Solana token approval is a delegate on one token account, and revoking it is a single cheap instruction signed by you. Scan the whole wallet rather than guessing, revoke anything you cannot trace to an app you use, and expect a clean wallet to show none. Solflare, the spl-token CLI, third-party revokers and SOLTidy's free Revoke Delegations tool all do the same job. Just remember the limit: revoking fixes an approval, not a leaked key.
Questions & answers
How do I check which token approvals my Solana wallet has?
Scan every token account the wallet owns for a delegate field. Solflare lists them under Settings, Security and Privacy, Spending Approvals, at the time of writing. A free scanner such as SOLTidy's Revoke Delegations tool reads all SPL Token and Token-2022 accounts for any pasted address without connecting, and shows each delegate, its allowance and your balance. A clean wallet usually shows none.
How much does it cost to revoke a token approval on Solana?
Revoking costs only the Solana network fee, a 5,000-lamport base fee (0.000005 SOL) per transaction plus any small priority fee. Revoke creates and closes no accounts, so no rent is involved, and many Revoke instructions fit in one transaction. Wallet menus, the spl-token CLI and SOLTidy's Revoke Delegations tool all charge nothing on top.
Does disconnecting a site from Phantom revoke its token approvals?
No. Disconnecting stops a site from seeing your address and asking for signatures, but a delegate is stored on the token account on chain and stays there. Phantom's own help center makes this distinction. To remove the approval you need a transaction containing a Revoke instruction, signed by the token account's owner.
Why can't I revoke a delegate on one of my token accounts?
The usual reason is that the account is frozen. The token program rejects any instruction that touches a frozen account, Revoke included, until the token's freeze authority thaws it. A frozen account's tokens cannot move either, so the delegate cannot use the allowance while it stays frozen. Revoke tools should mark these accounts rather than fail the whole batch.
Is a delegate on my token account a sign my wallet is hacked?
Not by itself. You had to sign the Approve, and some staking, order and older NFT listing programs use delegates legitimately. Look the delegate address up in an explorer and match it to an app you used. An unknown delegate covering your whole balance of a valuable token is a red flag worth revoking at once, but tokens moving with no delegate involved points to a leaked key instead.
Should I revoke approvals after my Solana wallet was drained?
Only if you are sure the seed phrase is safe and the loss came from one bad signature. If the key itself leaked, the attacker can sign a new Approve or transfer directly, so revoking achieves nothing. In that case move what remains to a wallet with a new seed phrase first, and treat revoking as a later cleanup step.
