Why does disconnecting a wallet not revoke token approvals?

Disconnecting a wallet usually ends the interface connection between a website and an address, but it does not cancel permissions already granted to smart contracts onchain. If a contract can spend a token, that authority remains until a separate revoke transaction or allowance change. Closing a tab, logging out or removing the connection is not enough.

What does Disconnect do?#

It removes the relationship between a site and the selected account in the wallet interface. The site stops automatically seeing the active address or initiating new requests through that connection. Confirmed transactions and contract state remain onchain.

MetaMask explicitly explains that disconnecting does not revoke token approvals. They are separate permission layers.

What is an approval or allowance?#

Before a swap or deposit, a user often authorizes a contract to move a specific ERC-20 token. The permission is recorded onchain and may be limited to an amount or effectively unlimited.

If the contract is vulnerable, controlled by an attacker or approved through phishing, that authority can be used later. Disconnecting the website does not block it.

How is permission revoked?#

A new onchain transaction must reduce the allowance or set it to zero. The MetaMask revocation guide describes built-in and explorer-based ways to review approvals.

Because revocation changes blockchain state, it costs gas. The correct network matters because permissions exist separately on every network and token contract.

What are the limits and risks?#

An approval list may look empty when the wrong address or network is selected. A third-party revocation service can itself be phishing, so its domain and requested transaction must be checked.

Revocation cannot recover stolen funds or solve a leaked recovery phrase. A compromised key requires moving assets to a new safe wallet, not only removing allowances.

Which habit reduces risk?#

Grant the smallest practical limit, use a separate wallet for unfamiliar dapps and review allowances regularly. Revoke unnecessary permissions after risky interactions.

This does not guarantee safety, but understanding disconnect versus revoke closes a common and costly gap.