Wallet Health Check

A single 0-100 grade for how exposed your wallet is through its token approvals. It starts at 100 and drops for each risky approval, more for a dangerous one (unlimited allowance to an unverified or malicious spender) than for a lower-risk one. Any dangerous approval caps you at 'at risk'.

Revoke the risky approvals the check lists, especially unlimited allowances to unverified or flagged contracts. Each revoke you send from your own wallet raises your score. Then keep it high by watching the wallet so new risky approvals are caught early.

Yes. It reads a public address only, the same string anyone can see on a block explorer. No wallet connection, no private key, nothing to sign. It cannot move your funds.

An approval is permission you grant a contract to move a specific token out of your wallet. It is how every decentralised exchange works, so you cannot avoid them. The danger is the amount and the recipient: most apps ask for an UNLIMITED allowance because it saves you a transaction later, and that allowance stays live forever. If that contract is malicious, or is compromised years later, it can take the whole balance without asking you again.

Set the allowance back to zero from the wallet that granted it, which is a transaction you send yourself and pay gas for. Revoke.cash and your wallet's own approval screen both do this, as does any block explorer's write tab. Veriql deliberately does not do it for you: revoking requires signing, and this site never asks you to connect a wallet or sign anything. It tells you exactly what to revoke and you do it where you already trust the tooling.

Ethereum, Base, Arbitrum, Polygon and BNB Chain, scanned together from one address. Those five carry the overwhelming majority of EVM approval risk. An address that looks clean on Ethereum frequently has an old unlimited approval sitting on a layer 2 that its owner forgot about years ago, which is exactly the case a single-chain check misses.

A Permit (EIP-2612 or Permit2) is an off-chain signature that approves a spender with no on-chain transaction. In 2024 it accounted for 56.7% of the value taken in large phishing losses (Scam Sniffer). The Guardian browser extension warns you before you sign it.

EIP-7702 lets your wallet hand its whole account over to a contract's code. Drainers trick you into signing a delegation to their “sweeper.” After Ethereum's Pectra upgrade, Wintermute found the same copy-pasted sweeper code behind over 97% of all EIP-7702 delegations. It's the newest one-signature drain, and revoking approvals won't undo it. The Guardian decodes the delegation and throws a full-screen STOP before you sign.

Each finding links to revoke.cash, where you sign the revoke from your own wallet. Plans are priced in USD and paid in the coin you choose, with no silent auto-charge: you renew when you choose, and a plan simply lapses back to free if you don't.