MetaMask is one of the most widely used DeFi wallets for good reason. They have millions of users worldwide and a fantastic track record of security. However, while the MetaMask app itself is generally considered to be safe, it can only do so much to protect you from potential crypto rug pulls.
Part of what makes MetaMask so powerful is that it’s a self-custodial wallet. This means that users have complete control over the dapps and tokens that they allow their wallet to interact with. While this gives them the freedom to interact with the universe of web3 and DeFi yield farming projects, it also means that they are only a few clicks away from a phishing scam or honeypot stealing their funds.
To stay safe in the world of DeFi, this means that users need to be adept at understanding the approvals and permissions granted by their wallet. If you’re auditing your MetaMask wallet and looking to find a way to remove potentially harmful permissions, you’re in the right place.
In this blog, we’ll walk through what MetaMask permissions are and how you can audit + revoke them using the free De.Fi Shield tool.
MetaMask permissions can go by many names including smart contract permissions, token allowances, token approvals, etc. To be clear though, these are all referencing the same concept: settings within your wallet that allow for dapps to access and move crypto assets on your behalf.
Examples of this could include a DEX like Uniswap or an NFT exchange like OpenSea. When you are interacting with these platforms, the only way for them to fulfill their duties is for you to allow their underlying smart contract to interact with and extract the crypto assets you wish to use. This is done by signing an approval with your MetaMask wallet.
In the screenshot below, you can see the process of granting MetaMask permissions for the Uniswap dapp to interact with the USDT stablecoin stored within a wallet. This token approval uses a specific custom spending cap as well:
These permissions are incredibly powerful because they allow the smart contract you interact with to have control over your funds even if you do not approve a specific transaction. This can lead to a nightmare scenario of losing access to your funds under the following circumstances:
You grant approvals to an untrustworthy smart contract: Token approvals are the main attack vector for crypto phishing scams. If you’ve approved a malicious contract to be an unlimited spender of a token, your entire balance will likely be wiped out nearly instantly after the approval is confirmed.
You grant approvals to a smart contract which is eventually compromised: If a contract that you’ve interacted with before has a vulnerability and is hacked, the hackers may find a way to transfer all tokens from users who have previously granted token approvals to the breached contract. An example of this was the infamous Multichain bridge hack:
Someone is exploiting this literally *right now*. If you haven’t revoked approvals yet you should probably do so before it’s too late. https://t.co/vkjGsrUgdk
— samczsun (@samczsun) January 18, 2022
This is especially dangerous because many dapps prefer to request these unlimited token approvals from users so that they don’t have to call approve() repeatedly. While this is gas efficient, doing so leaves users exposed to a high level of risk.
A common point of confusion for users who are looking to revoke MetaMask wallet permissions is that they use the “Connected sites” functionality within MetaMask instead of a proper revoke permissions tool:
The connected sites feature of MetaMask is useful because it gives you a quick overview of what sites you’ve connected to in the past. However, it is NOT a replacement for revoking permissions from an app.
Disconnecting a site via these settings will simply limit that site’s ability to see your public address, token balances, and (depending on the specific permissions you granted) ability to initiate a transaction on your behalf (not execute the transaction). It will do nothing regarding limiting the underlying permissions that you’ve granted the app’s smart contract to the tokens within your wallet.
MetaMask has no way for users to revoke permissions from smart contracts from within the app itself. However, the De.Fi SuperApp has you covered.
As part of our De.Fi DeFi portfolio tracker SuperApp, we make it easy to efficiently monitor and revoke your MetaMask permissions to keep you safe from potential hacks and scams. Our De.Fi Shield revoke permissions tool is the perfect accessory for safety-conscious MetaMask users.
Sample De.Fi Shield wallet analysis
To get started, simply navigate to https://de.fi/shield and connect your MetaMask to the De.Fi app. Once connected, Shield automatically runs an analysis of 100+ security detectors for each contract, token, and NFT approval. It will then identify all high-risk tokens and smart contracts and provide a detailed description of potential risks. The whole process happens in only a few seconds.
Once high-risk contracts are identified, you have the opportunity to revoke them one by one or to revoke them all at once:
Choosing to revoke will trigger a pop-up that confirms the action and provides approximate gas fee data for the task
Hitting “Revoke” once again will then trigger an approval process within MetaMask:
Once these transactions are approved, you’re all set! De.Fi Shield will update with your new and improved wallet health score free of risky permissions:
Ready to get started auditing and securing your MetaMask wallet? Click the link below!
While it is critical to monitor and maintain your MetaMask wallet’s token approvals, we also recommend being vigilant and ensuring you don’t interact with risky contracts in the first place. With this in mind, we offer De.Fi Scanner, the most comprehensive free smart contract scanner in web3.
DeFi users leverage Scanner to run automated audits on projects, tokens, NFTs, or even liquidity pool contract addresses. Simply enter the contract address you would like to analyze and Scanner will produce a security report in a matter of minutes highlighting any potential risk issues you should be aware of.
Users can also freely access a treasure trove of security analysis via our Audit Database. It’s web3’s largest database of DeFi project audits with over 9000 security reports from blockchain experts. If you’re considering interacting with a DeFi protocol, chances are you can find a security report within our database.
For the latest security news, don’t forget to follow our De.Fi Security X profile. We’ll keep you notified of any security incidents as they happen, giving you the time you need to respond appropriately. Educate yourself and stay safe with De.Fi!
November 3 • 6 minutes
In this blog, we'll walk through what Gnosis token approvals are and how you can audit + revoke them using the free De.Fi Shield tool.
April 19 • 7 minutes
During Q1 2024 ... total losses amounting to $414,875,820 across a range of exploits and security incidents.
April 1 • 10 minutes
Among the many options available, Phantom Wallet has emerged as a popular choice for those in the Solana ecosystem, sparking questions about its safety, legitimacy, and features.
March 22 • 17 minutes
A total of $148,690,165 was lost across various platforms and chains due to diverse exploits.
March 2 • 11 minutes
Celo token approvals can go by many names including token permissions, smart contract permissions, token allowances, etc.
February 23 • 7 minutes
The top three largest governance hacks resulted in $414M in losses over the years
February 12 • 5 minutes
© De.Fi. All rights reserved.
