Connection Permissions vs. Spending Permissions
When a website connects to your wallet, it may gain the ability to view your account address or request signatures. Token spending allowances, however, are governed by on-chain smart contract rules. Disconnecting a website typically only severs the link between the wallet and the site; it does not automatically revoke existing on-chain authorizations. You should identify which specific layer of permission you wish to terminate and take the appropriate action, rather than simply checking whether the site has disappeared from a list.
Three Categories to Review
The first category consists of site connections stored by browser-based wallets; the second involves token allowances granted to specific "spenders"; and the third includes session-based permissions for certain smart accounts or applications. Sessions may also have expiration dates, defined contract scopes, and spending limits. Implementations vary significantly across different wallets—consult the official documentation for your specific wallet. Do not assume that all wallets feature the same controls, and do not equate a website name with a single, unique contract address.
Signatures Can Also Establish Ongoing Permissions
Some applications use off-chain signatures as a basis for future actions; the fact that no on-chain transaction was broadcast does not mean the signature is inconsequential. Always verify the network, the contract involved, the specific action, the expiration date, and any spending limits associated with a signature request. Do not rely on the absence of a "gas fee" as an indicator of safety when encountering unfamiliar "blind" signatures. Whether a previously signed action can be revoked depends on the protocol's design; simply clearing your browser history or reinstalling a wallet extension does not guarantee that such permissions are invalidated.
Determining the Scope of Revocation Based on Evidence
Begin by documenting previously connected websites, networks, and associated transactions. Locate the relevant authorization contracts and their specified limits, then verify these details using the wallet’s official interface or a trusted tool. On-chain revocation may incur network transaction fees; ensure that the transaction you are initiating is indeed a revocation, rather than a new, "unlimited" authorization. Avoid interacting with suspicious assets or unfamiliar contracts—consult your wallet’s official guidance first, and seek reliable support if necessary.
If You Suspect Your Private Key Has Been Compromised
Revoking a single authorization cannot resolve a private key compromise. Distinguish between a compromised account and malicious authorizations, and develop a remediation plan using a secure, trusted device. Never enter a new seed phrase into a device that may be compromised, and do not transfer your entire balance to an address suggested by a stranger. Throughout the remediation process, keep a record of all transactions and timestamps. Avoid publicly disclosing unredacted account details, and—crucially—never share your private key with individuals claiming to be "asset recovery" specialists.
Creating a Permission-Termination Checklist
Systematically verify that website connections have been severed, target authorizations have been revoked, and active sessions have expired or been terminated. Check for any remaining network permissions. Once completed, verify the current on-chain status and retain the transaction identifiers (TXIDs). This document does not guarantee the security of any specific wallet; the outcome of any revocation depends on the current state of the network and the relevant protocols. Ongoing maintenance—such as ensuring the security of your devices and protecting your recovery information—remains essential.