Spender Allowlist Manager

WHAT IT DOES

Spender Allowlist Manager helps you take control of your token approvals by letting you define a trusted list of spenders and then revoking any approval that falls outside that list. Instead of manually checking each spender, you maintain an allowlist of addresses you trust—for example, exchanges, DEX routers, or dApps you use regularly. The tool scans your active ERC-20 allowances and NFT operator approvals across multiple tokens, compares each spender against your allowlist, and highlights those that are not trusted. You can then revoke individual spenders or batch-revoke all non-allowlisted approvals in one go.

HOW TO USE

Connect your EVM wallet and select the network. Enter your allowlisted spender addresses in the text area—one per line. You can also add addresses individually using the "Add" field. Next, provide the token contract addresses you want to scan, one per line. If you leave the token list empty, the tool will attempt to discover tokens from your wallet's Approval logs (this may take longer). Click "Scan approvals" to fetch all active allowances and operator approvals for those tokens. The results table shows each spender, the token, the approved amount, and whether the spender is on your allowlist. Use "Revoke non-allowlisted" to clear all approvals that are not on your trusted list, or "Revoke all" to reset every approval regardless of the allowlist.

TECHNICAL MECHANISM

The tool combines log scanning with on-chain state verification. It starts by querying Approval (for ERC-20) and ApprovalForAll (for NFTs) events from the chain, walking backwards in adaptive chunks. Public RPCs often cap block ranges—the tool automatically halves the chunk size when it hits a limit and retries, ensuring scans complete even on restrictive providers. After collecting potential spenders from logs, it double-checks every entry against the current contract state using allowance() or isApprovedForAll(). This eliminates false positives from approvals that were later revoked or overwritten. The allowlist is maintained entirely client-side; no data is stored or transmitted. Revocations are performed sequentially using approve(spender, 0) for ERC-20 and setApprovalForAll(spender, false) for NFTs, with progress feedback.

WHAT IT CANNOT SEE

This tool cannot detect or block approvals created after the scan—you must re-scan to capture new allowances. It does not monitor pending transactions or off-chain approval requests (e.g., signed permits that have not been submitted). Approvals set through proxy contracts or delegate-call patterns that store allowances at different addresses are not visible. The tool relies on the standard ERC-20 and ERC-721/1155 interfaces; non-standard or custom token implementations may not be detected correctly. It also does not scan for approvals across all possible tokens automatically—you must specify which tokens to inspect.

PLEASE NOTE

The allowlist is stored only in your browser's memory and resets on page reload. Always re-scan after modifying your allowlist to see updated results. Revoking approvals requires gas fees paid by your wallet. This tool is for EVM chains only and does not support non-EVM networks. Use it as part of a broader security routine, not as a real-time monitoring solution.