Revoke.cash Extension

Every DeFi or NFT click that asks “Allow USDC?” leaves a standing spend permission onchain. Unlimited approvals to a router you used once in 2021 still work in 2026. When that contract gets exploited or was malicious from day one, the attacker does not need your seed. They call transferFrom. Hardware wallets do not save you here. Disconnecting MetaMask from a site does not revoke anything. That is the problem Revoke.cash was built for.

Rosco Kalis shipped the tool in 2019. Flow is simple: open revoke.cash, connect a wallet or paste any address / ENS, pick a network, see every spender still approved, sort/filter, revoke what you do not need. You sign the revoke tx and pay gas. Supports 100+ EVM chains and Solana (Solana depth historically thinner than EVM but present). Works with MetaMask, Rabby, Ledger-connected wallets, and most mainstream connectors. Public address lookup means you can audit a cold wallet without importing keys. Exploit checker maps your allowances against known bad spenders.

The browser extension (Chrome Web Store listing as Revoke.cash / Revoke Sidekick) is the proactive half. Older versions mainly flagged dangerous approvals at sign time. The 2026 rebuild with Fairside turns it into broader scam protection: simulate the tx before Confirm (what leaves, what arrives, what approvals get set), check approvals from the popup, warn on Google Ads phishing for DeFi brands, flag address poisoning on explorers, surface Ethos-style reputation on X, and on paid plans add hold-to-confirm friction plus theft coverage marketed up to $30,000. Lite is free with the core simulation / approval / Ethos pieces. Standard unlocks the heavier anti-phishing and coverage features via in-app purchase. Extension focuses on major EVM networks (Ethereum, BNB Chain, Polygon called out explicitly). Install only from the official store listing. Fake “revoke” extensions are an obvious phishing vector.

Paid web tiers (pricing pages cite monitoring packages starting around $99/year) expand past one-off hygiene: multichain dashboards, exploit checking across chains, batch revoke economics, continuous monitoring, and Ultimate-style Auto-Revoking. Auto-revoke uses ERC-7715 scoped permissions (currently MetaMask-first) so Revoke can only submit approval-revocation actions, not grant new spends or move tokens. Gas budget inclusions and network lists (Ethereum, Base, Arbitrum, OP, Polygon, etc.) move with product updates. Read the live pricing page before you buy.

What it is not: a wallet, a recovery service, or antivirus that undoes a signed drain. Official FAQ is blunt. If a sweeper already owns your seed, revoking approvals is theater. Move to a new wallet. If funds left via an active allowance, revoke so they cannot take the rest, but the first loss stays lost. Coverage on Standard is insurance-shaped product language from the Fairside partnership. Treat claim rules and exclusions as fine print, not a magic shield.

Open source history: the main web/monorepo culture has been open. The extension moved toward closed source in the Fairside era so detection rules are harder for attackers to reverse-engineer. That is a real trade for transparency maximalists. Trust then sits on brand track record, store reviews, and the partner stack.

Versus Rabby / MetaMask security alerts: those wallets bake some simulation in. Revoke specializes in approval inventory and revocation ops across many chains, plus extension layers wallets may not cover (ads, poisoning on explorers, X impersonators). Versus Etherscan token approval pages: Revoke is multichain UX and batch workflows. Versus doing nothing: most active DeFi users accumulate dangerous allowances without noticing.

Who it’s for: anyone who signs DeFi/NFT txs regularly and wants periodic approval cleanup, plus users who want a second opinion before Confirm. Who should skip expecting miracles: people whose seed is already compromised, and users who will ignore warnings and spam Confirm anyway.

STRENGTHS

- Category-defining approval inspector/revoker across 100+ networks including Solana

- Clear explanation of a risk most beginners misunderstand (approvals ≠ seed theft)

- Extension adds pre-sign simulation and real-world scam surfaces (ads, poisoning, impersonators)

- Free Lite path and public address lookup without forcing a subscription

- Auto-Revoke / Premium path for set-and-forget hygiene where ERC-7715 wallets support it

- Long track record since 2019. Exploit lists and core tooling have public/GitHub roots

- Works with normal wallets. Does not ask you to migrate funds into a new custody product

WEAKNESSES

- Cannot recover stolen funds. Prevention and cleanup only

- Every revoke costs network gas. Neglect plus mainnet fees = people postpone hygiene

- Extension closed-source shift and Fairside dependency reduce “fully auditable client” purity

- Paid tiers / theft coverage add subscription complexity and claim fine print

- Auto-Revoke wallet/network support is incomplete (MetaMask-first, selected chains)

- Solana and long-tail chains can feel thinner than the flagship EVM experience

- Simulation and warnings still fail if you override them or sign off-platform (mobile dApp browser, another device)

- Fake clone sites/extensions targeting the Revoke brand are themselves a phishing risk