AuditXWhat has this wallet approved — and could still be drained?
Paste any EVM wallet address. This scans its real on-chain Approval events and shows every ERC-20 allowance and NFT operator approval still active — flagging the unlimited ones, the single most common wallet-draining vector. It never asks you to connect a wallet, because reading approvals only needs the public address.
How this works
Every time you approve a dApp to spend a token, the token contract emits an on-chain Approval event. This tool reads all of those events for the address you paste (via Blockscout's public, keyless API), then reads the current live allowance() for each token+spender pair straight from the chain — so a value you've already revoked shows as gone, not stale. For NFTs it does the same with ApprovalForAll operator grants, verified live against isApprovedForAll().
An active approval does not mean funds will be stolen — it means that spender is technically able to move up to the allowance amount without asking you again. Legitimate DEXs and marketplaces need approvals to work. The risk is an unlimited approval to a contract you no longer trust, or one that turns out to be malicious.
To actually revoke an approval you must send a transaction from the wallet that owns it — this page can't and won't do that for you. Use the Revoke link on any row (it opens revoke.cash, the standard open-source revoker) with your own wallet.