Solana · token approvals · read-only

Who else can move your tokens?

Apps you once approved can keep the right to spend a token. Some tokens give their issuer a permanent key to every holder's balance. Paste a wallet and see every one of those, in plain words.

Only your public address is needed. We never ask for your seed phrase or a signature.

Paste a wallet above. We read every SPL Token and Token-2022 account it owns straight from Solana, plus the Token-2022 mint settings of what it holds.

What we look for

Four ways someone else keeps a hand on your tokens.

Delegate (approval)

Your token account names another address that may spend up to an allowance of that token without asking you again. Limit orders, DCA and some marketplaces set one on purpose. Drainers set one too. It stays until it is used up or revoked.

Permanent delegate

A Token-2022 setting on the token itself. One key can move or burn any holder's balance, any time, and you cannot revoke it. Normal for regulated stablecoins and tokenised stocks; a red flag on a random meme coin.

Close authority

Someone other than you may close the account once it is empty and take its rent deposit (about 0.002 SOL). Low risk, but it means an app touched this account.

Frozen, hooks, pausable

The issuer froze your account, the token runs a transfer-hook program on every transfer, or the issuer can pause all transfers. Not a theft risk by itself, but it limits what you can do with the token.

Clean up

How to remove an approval.

This site never builds or asks you to sign a transaction. Do the clean-up in your own wallet, on a site you reached by typing its address yourself.

Fake "revoke" sites are a common drainer trick. If someone DMs you a link to "revoke approvals" or "claim a refund", close it. Revoking never needs your seed phrase.

Delegate on a token account

  1. Cancel the order in the app that set it. Open limit orders, DCA plans and marketplace listings usually hold the delegate; cancelling the order there removes it.
  2. Phantom / Solflare: open the token and look for a revoke or approvals option. Wallet menus change between versions; if yours has none, use step 3 or 4.
  3. Move the balance out. Send the tokens to a fresh wallet you control. A delegate can only spend from the old account, which is now empty.
  4. Command line: spl-token revoke <TOKEN_ACCOUNT> signed by the owner key, from the official Solana tools.

Permanent delegate

Cannot be revoked by holders. The only exit is to not hold the token. For regulated stablecoins this is the issuer's compliance key and is expected; for anything else treat it as "the creator can take it back".

Close authority

Only matters once the account is empty, and only the rent deposit is at stake. Send the balance to a new account if you want it gone.

Questions

Does a delegate mean I was drained?

No. Many normal apps set one while an order is open. It means that address can spend up to the shown allowance from that one token account. Check whether you recognise the app; if not, remove it.

What can this scan not see?

If a drainer already changed the owner of a token account, that account no longer shows up under your wallet. Check your history for "SetAuthority" with ApprovalWatch. Compressed NFTs and staking delegations are not covered here.

Do you store my address?

No accounts, no cookies for tracking. The server caches each result for one minute so repeat loads do not hammer the RPC, then forgets it.